CVE-2026-79154: Chrome DevTools Authorization Vulnerability

CVE-2026-79154 Overview

CVE-2026-79154 is a missing authorization vulnerability in the DevTools component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can leverage social engineering to trick a user into performing specific UI interactions that expose sensitive information. The underlying weakness is classified as Missing Authorization [CWE-862]. Chromium security rates this issue Medium severity. Exploitation requires user interaction, which limits mass exploitation but remains viable in targeted phishing scenarios.

Critical Impact
Successful exploitation allows a remote attacker to obtain sensitive information from a user's browser session through crafted DevTools UI interactions.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable DevTools component
Stable channel builds released before the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-79154 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79154

Vulnerability Analysis

The vulnerability resides in Chrome's DevTools interface. DevTools lacks a proper authorization check before exposing certain sensitive data through the developer UI. An attacker cannot exploit the flaw directly over the network. Instead, the attacker must convince a target user to visit an attacker-controlled page and perform specific interactions with the browser or DevTools panel. Once the interaction sequence executes, DevTools returns data that should have been gated by an authorization check.

Root Cause

The root cause is a Missing Authorization condition [CWE-862] within DevTools code paths that surface sensitive browser state. The affected functionality trusts that any caller invoking the DevTools interface is authorized to receive the underlying data. No verification enforces origin, context, or user consent before information is returned. Google addressed the defect in Chrome 152.0.7977.65. Tracking details are available in Chromium Issue #520492291.

Attack Vector

The attack requires network delivery and user interaction. A typical exploitation chain begins with a phishing lure that directs the victim to open a malicious page. The attacker then guides the user through UI steps, such as opening DevTools, clicking a control, or pasting content into a panel. These interactions trigger the unauthorized code path and disclose sensitive information back to attacker-controlled content. The vulnerability affects confidentiality only. Integrity and availability are not impacted.

No verified public exploit code is available for this vulnerability. See the Chromium tracker for additional technical context.

Detection Methods for CVE-2026-79154

Indicators of Compromise

Browser telemetry showing DevTools sessions opened immediately after navigation to unfamiliar external domains
Outbound requests from browser processes carrying data that resembles internal browser state or session artifacts
User reports of pages instructing them to open DevTools or paste content into the console

Detection Strategies

Inventory Chrome installations across the fleet and flag any endpoint running a version below 152.0.7977.65
Monitor web proxy logs for phishing pages that use "self-XSS" style social-engineering scripts steering users into DevTools
Correlate browser process telemetry with newly launched DevTools instances tied to non-corporate domains

Monitoring Recommendations

Ingest Chrome version data into the security data lake and alert on outdated builds
Track browser child-process and DevTools activity through endpoint telemetry for anomaly review
Review email and web gateway logs for lures that instruct users to open developer tools

How to Mitigate CVE-2026-79154

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force browser restarts through management tooling to ensure the patched binary is active
Notify users about phishing campaigns that instruct victims to open DevTools or paste content into the console

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update announcement. Administrators should deploy Chrome 152.0.7977.65 or newer across Windows, macOS, and Linux endpoints. Downstream Chromium-based browsers should be updated once their vendors integrate the corresponding patch.

Workarounds

Use enterprise policy to restrict DevTools access on managed profiles where developer tooling is not required
Deliver targeted awareness training that warns users against following instructions to open DevTools from untrusted websites
Enforce web filtering that blocks known phishing and social-engineering domains

bash

# Example: disable DevTools via Chrome enterprise policy on Linux
# /etc/opt/chrome/policies/managed/devtools-policy.json
{
  "DeveloperToolsAvailability": 2
}