CVE-2026-79126 Overview
CVE-2026-79126 is an information disclosure vulnerability in the Proxy component of Google Chrome on Windows. Versions prior to 152.0.7977.65 incorrectly provide specified functionality, allowing an adjacent network attacker to obtain sensitive information through crafted network traffic. The issue is tracked under CWE-684: Incorrect Provision of Specified Functionality. Google classifies the Chromium security severity as Low, while NVD scores it as Medium. Exploitation requires network proximity and elevated attack complexity, limiting mass exploitation potential.
Critical Impact
An adjacent attacker can potentially intercept or obtain sensitive information transiting Chrome's proxy handling on Windows systems by injecting or manipulating crafted network traffic.
Affected Products
- Google Chrome on Windows versions prior to 152.0.7977.65
- Microsoft Windows operating systems running vulnerable Chrome builds
- Chromium-based deployments inheriting the affected proxy component
Discovery Timeline
- 2026-08-25 - CVE-2026-79126 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79126
Vulnerability Analysis
The flaw resides in Chrome's Proxy component on Windows. The component incorrectly provides functionality that is specified for a different security context, resulting in information exposure. An adjacent attacker positioned on the same broadcast or logical network segment can craft traffic that induces Chrome to leak sensitive data through its proxy handling logic.
Because the vulnerability requires an adjacent network position and high attack complexity, opportunistic exploitation across the internet is unlikely. Targeted scenarios include shared corporate LANs, public Wi-Fi, and untrusted VPN segments. The confidentiality-focused nature of the flaw means integrity and availability of the browser remain intact.
Root Cause
The root cause is categorized as CWE-684, incorrect provision of specified functionality. Chrome's proxy code path executes a behavior that does not match its documented security guarantees, exposing data that should remain scoped to the requesting origin or configured proxy channel.
Attack Vector
Exploitation requires the attacker to be adjacent on the network and to send specifically crafted network traffic to the Chrome instance. No authentication or user interaction is required. See the Chromium Issue Tracker entry #533408915 and the Google Chrome Stable Channel Update for vendor detail.
No public proof-of-concept or exploit code is available at the time of publication. The vulnerability mechanism is described in prose because no verified exploitation code has been released by the vendor or researchers.
Detection Methods for CVE-2026-79126
Indicators of Compromise
- Chrome installations on Windows reporting a version string below 152.0.7977.65 in chrome://version.
- Unexpected proxy configuration changes or PAC script evaluations in Chrome enterprise telemetry.
- Anomalous outbound connections from Chrome to unauthorized proxy hosts on local network segments.
Detection Strategies
- Inventory Chrome versions across managed Windows endpoints using software asset management or endpoint agents, and flag hosts below the fixed build.
- Monitor local network segments for ARP spoofing, rogue DHCP, and WPAD poisoning attempts that could position an attacker adjacent to Chrome clients.
- Correlate browser network telemetry with unusual DNS lookups for wpad, proxy, or PAC hosting endpoints.
Monitoring Recommendations
- Alert on Chrome processes making proxy discovery requests to unmanaged or unexpected internal hosts.
- Track enterprise policy compliance for ProxySettings and disable automatic proxy detection where not required.
- Ingest Chrome browser logs and Windows network events into a centralized analytics platform for cross-host correlation.
How to Mitigate CVE-2026-79126
Immediate Actions Required
- Update Google Chrome on all Windows endpoints to version 152.0.7977.65 or later.
- Validate the deployed build using chrome://settings/help or centralized software inventory.
- Restrict use of untrusted Wi-Fi and shared LAN segments for privileged browsing sessions until patching is complete.
Patch Information
Google released the fix in the Chrome Stable channel update tracked in the Google Chrome Stable Channel Update advisory. Enterprise administrators should deploy Chrome 152.0.7977.65 or later through managed update channels such as Chrome Browser Enterprise, Microsoft Intune, or SCCM.
Workarounds
- Disable automatic proxy detection (WPAD) via Group Policy where it is not operationally required.
- Enforce explicit proxy configuration via the ProxyMode and ProxyServer enterprise policies to remove reliance on discovery.
- Segment client networks and disable unnecessary Layer 2 adjacency between untrusted devices and managed workstations.
# Configuration example: Enforce explicit proxy and disable auto-detection via Chrome enterprise policy (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome" /v ProxyMode /t REG_SZ /d "fixed_servers" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v ProxyServer /t REG_SZ /d "proxy.example.com:8080" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v ProxyBypassList /t REG_SZ /d "*.internal.example.com" /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
