CVE-2026-79133: Google Chrome Information Disclosure Flaw

CVE-2026-79133 Overview

CVE-2026-79133 is an incorrect authorization vulnerability in the Forms component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65 and allows a remote attacker to obtain sensitive information through a crafted HTML page. The vulnerability requires user interaction, meaning a victim must visit an attacker-controlled or compromised page for exploitation to succeed. Chromium classifies the underlying security severity as Low, while the assigned CVSS score reflects a higher confidentiality impact due to the network-reachable attack surface. The weakness is categorized under [CWE-863: Incorrect Authorization].

Critical Impact
Remote attackers can exfiltrate sensitive information from Chrome users through a crafted HTML page, without authentication.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers sharing the affected Forms component
Desktop Chrome installations across supported platforms

Discovery Timeline

2026-08-25 - CVE-2026-79133 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79133

Vulnerability Analysis

The vulnerability resides in Chrome's Forms implementation. The component performs an authorization check that does not correctly enforce origin or context boundaries when handling form-related data. As a result, a crafted HTML page can coerce the browser into exposing information that should remain restricted to its originating context. The issue is remotely reachable over the network and requires the victim to load or interact with a malicious page. Successful exploitation impacts confidentiality but does not modify data or affect availability, aligning with the described information disclosure outcome.

Root Cause

The root cause is an incorrect authorization check [CWE-863] within the Forms subsystem. The component fails to consistently validate whether the requesting context is permitted to access specific form-associated data. Missing or misapplied policy enforcement allows a crafted page to bypass intended boundaries. Google addressed the defect in Chrome 152.0.7977.65 by tightening the authorization logic. Additional technical detail is tracked in the upstream bug report referenced in the Chromium Issue #533075126.

Attack Vector

Exploitation proceeds over the network and requires user interaction. An attacker hosts a crafted HTML page or injects malicious content into a page the victim visits. When the browser renders the page, the Forms authorization flaw is triggered and sensitive data becomes accessible to attacker-controlled script. No credentials or prior access to the target system are required. Refer to the Google Chrome Desktop Update advisory for vendor guidance.

Detection Methods for CVE-2026-79133

Indicators of Compromise

Chrome browser processes loading unexpected third-party HTML pages that reference form elements from cross-origin contexts.
Outbound requests from browser sessions containing form field values or DOM data sent to untrusted domains.
Endpoint telemetry showing Chrome versions below 152.0.7977.65 still active in the environment.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build earlier than 152.0.7977.65.
Monitor web proxy and DNS logs for user visits to newly registered or low-reputation domains that host HTML form-heavy content.
Correlate browser process telemetry with outbound HTTP POST bodies containing sensitive field patterns leaving the network.

Monitoring Recommendations

Enable managed Chrome update reporting through enterprise policy to confirm patch adoption.
Track EPSS updates for CVE-2026-79133 and adjust prioritization if exploitability signals increase.
Alert on Chrome instances that fail to receive automatic stable channel updates within the standard rollout window.

How to Mitigate CVE-2026-79133

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Verify that automatic updates are enabled and not blocked by enterprise policy or network filtering.
Restart Chrome after updates apply to ensure the patched binary is loaded into memory.

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Desktop Update advisory. Users on 152.0.7977.65 or later are not affected. Chromium-based browsers should apply the corresponding vendor update once available.

Workarounds

Restrict browsing to trusted sites through enterprise URL allowlists until patching is complete.
Deploy browser isolation or remote browser technology for high-risk users handling sensitive data.
Disable or limit exposure to untrusted HTML content in email clients that render pages via Chrome components.

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version