CVE-2026-79134: Chrome GetUserMedia Information Disclosure

CVE-2026-79134 Overview

CVE-2026-79134 is an incorrect authorization vulnerability [CWE-863] in the GetUserMedia implementation of Google Chrome. Versions of Chrome prior to 152.0.7977.65 fail to correctly enforce authorization checks when a page requests access to media devices. A remote attacker can exploit this flaw by convincing a user to visit a crafted HTML page. Successful exploitation allows the attacker to obtain sensitive information from the browser context. Chromium classifies the security severity as Medium.

Critical Impact
Remote attackers can trick users into loading a malicious HTML page that abuses the GetUserMedia API to disclose sensitive information from the browser.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable GetUserMedia code path
Downstream distributions shipping unpatched Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79134 published to the National Vulnerability Database
2026-08-26 - Entry last updated in the NVD

Technical Details for CVE-2026-79134

Vulnerability Analysis

The flaw resides in Chrome's GetUserMedia Web API, which is responsible for granting web pages access to camera, microphone, and related media streams. The implementation performs an incorrect authorization check, allowing a crafted page to obtain sensitive information the browser should have restricted. Exploitation is network-based and requires the victim to load attacker-controlled content. The attacker does not need privileges on the target system. The confidentiality impact is high, while integrity and availability are unaffected.

Root Cause

The vulnerability is categorized as an incorrect authorization weakness [CWE-863]. The GetUserMedia code path fails to properly validate that the calling context is authorized to receive the requested data. This authorization gap permits information disclosure across a boundary that should have been enforced by Chrome's permission model.

Attack Vector

Exploitation follows a classic browser attack chain. An attacker hosts a crafted HTML page and lures a victim into visiting it through phishing, malvertising, or a compromised site. When the page is rendered, it invokes the affected GetUserMedia code path. The incorrect authorization check causes Chrome to expose sensitive data to the attacker's JavaScript context. Technical specifics are tracked in Chromium Issue Tracker #522351802 and the Google Chrome Stable Update.

Detection Methods for CVE-2026-79134

Indicators of Compromise

Browser telemetry showing Chrome versions earlier than 152.0.7977.65 in active use across managed endpoints.
Outbound HTTPS connections from browser processes to newly registered or low-reputation domains that host getUserMedia-heavy content.
Unusual browser process activity correlated with visits to untrusted HTML pages.

Detection Strategies

Inventory installed browser versions using endpoint management tooling and flag builds below 152.0.7977.65.
Correlate web proxy logs with threat intelligence feeds to identify user visits to suspicious pages requesting media permissions.
Review browser permission prompt logs, where available, for anomalous GetUserMedia requests from unexpected origins.

Monitoring Recommendations

Monitor Chrome auto-update status across the fleet and alert on stale versions.
Track the Chrome Stable Channel release feed to identify newly disclosed browser CVEs.
Alert on browser child processes making network connections shortly after visiting unclassified domains.

How to Mitigate CVE-2026-79134

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Force-restart Chrome after the update so the patched binary is loaded into memory.
Verify enterprise policies do not pin Chrome to an outdated major version.

Patch Information

Google addressed CVE-2026-79134 in the Chrome Stable channel with the release of version 152.0.7977.65. Details are available in the Google Chrome Stable Update and the associated Chromium Issue Tracker #522351802. Administrators should confirm that Chrome auto-update is enabled or deploy the fixed build via enterprise software distribution.

Workarounds

Restrict camera and microphone access by default using Chrome enterprise policies such as VideoCaptureAllowed and AudioCaptureAllowed.
Deploy URL filtering to block access to unclassified or high-risk domains until patching is complete.
Advise users to deny GetUserMedia permission prompts on untrusted sites and to avoid unsolicited links.

bash

# Example Chrome enterprise policy (Linux JSON policy)
{
  "VideoCaptureAllowed": false,
  "AudioCaptureAllowed": false,
  "DefaultNotificationsSetting": 2,
  "URLBlocklist": ["*"],
  "URLAllowlist": ["https://*.corp.example.com"]
}