CVE-2026-79148 Overview
CVE-2026-79148 is an off-by-one error [CWE-193] in the DevTools component of Google Chrome prior to version 152.0.7977.65. A remote attacker who convinces a user to install a crafted Chrome extension can read memory inside the browser sandbox. Chromium classifies the underlying security severity as Low, while the assigned NVD score is elevated due to network-reachable exploitation without required privileges. The flaw permits information disclosure from sandboxed memory regions and requires social engineering to deliver the malicious extension.
Critical Impact
A crafted Chrome extension can trigger an off-by-one read in DevTools, exposing memory contents inside the Chrome sandbox to a remote attacker.
Affected Products
- Google Chrome for Desktop prior to 152.0.7977.65
- Chromium-based builds incorporating the vulnerable DevTools code
- Chrome extensions ecosystem (attack delivery vector)
Discovery Timeline
- 2026-08-25 - CVE-2026-79148 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79148
Vulnerability Analysis
The vulnerability is an off-by-one error [CWE-193] within Chrome's DevTools code path. An off-by-one condition occurs when a loop or index calculation reads or writes one element past the intended boundary of a buffer or data structure. In this case, the miscalculation results in an out-of-bounds read of memory adjacent to a DevTools buffer.
Because the read occurs inside the renderer or DevTools process, the disclosed bytes remain within the Chrome sandbox. The attacker does not gain code execution but can potentially recover sensitive data such as pointers, tokens, or content from other structures in memory. Exploitation requires the victim to install a crafted extension, so social engineering is a prerequisite.
Root Cause
The root cause is an incorrect boundary calculation in DevTools handling logic. The affected routine iterates or indexes into a buffer using a length value that is one greater than the valid range, producing an off-by-one read. The Chromium project addressed the issue in the stable channel update leading to 152.0.7977.65.
Attack Vector
An attacker publishes or distributes a crafted Chrome extension that interacts with DevTools APIs in a way that triggers the miscounted boundary. The victim must be persuaded to install the extension, which then invokes the vulnerable code path from within the browser. The resulting memory disclosure is returned to attacker-controlled extension logic and can be exfiltrated to a remote endpoint.
No verified public exploit or proof-of-concept code is available. Refer to the Chromium Issue Tracker #532303080 and the Chrome Releases Update for vendor detail.
Detection Methods for CVE-2026-79148
Indicators of Compromise
- Newly installed Chrome extensions from unverified publishers or sideloaded .crx files outside the Chrome Web Store.
- Extensions requesting the devtools_page manifest key or broad debugger and management permissions.
- Outbound HTTPS traffic from Chrome to uncategorized domains shortly after DevTools activity in the browser.
Detection Strategies
- Inventory installed browser extensions across managed endpoints and flag any not on an approved allowlist.
- Inspect extension manifests for devtools_page, debugger, or unusually broad host permissions.
- Correlate Chrome process telemetry with unexpected child processes or network connections following extension installation events.
Monitoring Recommendations
- Monitor Chrome auto-update status and alert on endpoints running versions below 152.0.7977.65.
- Log extension installation and update events through enterprise browser management or endpoint telemetry.
- Track user reports of unsolicited extension prompts, developer-mode toggles, or crx sideload attempts.
How to Mitigate CVE-2026-79148
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed and unmanaged endpoints.
- Restart Chrome after the update to ensure the patched binary is loaded across all processes.
- Audit installed extensions and remove any that are not required or come from untrusted sources.
Patch Information
Google addressed the issue in the stable channel release documented in the Chrome Releases Update. Users running any Chrome desktop build prior to 152.0.7977.65 should upgrade immediately. Tracking details are available in the Chromium Issue Tracker #532303080.
Workarounds
- Enforce an extension allowlist through the ExtensionInstallAllowlist and ExtensionInstallBlocklist enterprise policies until patching completes.
- Disable developer mode and block sideloaded extensions using the DeveloperToolsAvailability policy where feasible.
- Educate users to reject unsolicited installation prompts and to install extensions only from the official Chrome Web Store.
# Enterprise policy example: restrict extensions and DevTools until patched
# Windows registry keys under HKLM\Software\Policies\Google\Chrome
ExtensionInstallBlocklist\1 = "*"
ExtensionInstallAllowlist\1 = "<approved-extension-id>"
DeveloperToolsAvailability = 2 # Disallow DevTools on force-installed extensions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
