CVE-2026-79176: Google Chrome Extensions Disclosure Flaw

CVE-2026-79176 Overview

CVE-2026-79176 is a user interface (UI) misrepresentation vulnerability in the Extensions component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65 on desktop platforms. A remote attacker can craft a malicious Chrome extension that visually misrepresents its behavior or origin to the user. Combined with social engineering, the attacker can trick users into disclosing sensitive information. The issue is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information and was rated Medium by the Chromium security team.

Critical Impact
Successful exploitation allows a remote attacker to obtain sensitive information from users through a crafted extension that visually deceives them.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers sharing the affected extensions UI code path
Google Chrome installations on Windows, macOS, and Linux

Discovery Timeline

2026-08-25 - CVE-2026-79176 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79176

Vulnerability Analysis

The vulnerability resides in how Chrome renders extension-related UI elements. An attacker-controlled extension can display information in a manner that misrepresents its identity, permissions, or output to the end user. This creates a phishing surface inside the browser chrome itself, where users typically expect trustworthy context.

Because the exploit requires the user to install and interact with the crafted extension, exploitation depends on social engineering. Once the user is deceived, the attacker can harvest credentials, session tokens, or other confidential data entered into the misrepresented UI. Confidentiality is directly impacted, while integrity and availability of the browser itself remain unaffected.

Root Cause

The root cause is improper rendering or lack of trust indicators for extension-generated UI. Chrome fails to sufficiently distinguish extension content from browser-controlled surfaces, allowing crafted extensions to imitate legitimate prompts, dialogs, or origin indicators. This maps to CWE-451, where security-relevant information is either not shown or is shown in a form the user can misinterpret.

Attack Vector

Exploitation follows a network-based delivery path with required user interaction. The attacker publishes or distributes a malicious extension, then convinces the target to install it through phishing, malicious advertising, or a compromised web page. Once installed, the extension renders a spoofed UI element that appears to originate from Chrome or a trusted site. The user submits sensitive information into that UI, which is then exfiltrated by the extension.

No proof-of-concept code has been published for this issue, and no public exploit is available at the time of writing. See the Chromium Issue Tracker Report for technical details from the vendor.

Detection Methods for CVE-2026-79176

Indicators of Compromise

Chrome browser version reporting a build earlier than 152.0.7977.65 in enterprise inventory data
Recently installed extensions from unknown or unverified publishers, particularly those requesting broad host permissions
Outbound network connections from chrome.exe child processes to domains not associated with the extension's stated purpose
User reports of unexpected login prompts, permission dialogs, or origin banners appearing inside the browser

Detection Strategies

Inventory installed Chrome extensions across the fleet and correlate extension IDs against known-good allowlists
Monitor endpoint telemetry for extension installations occurring outside managed deployment channels
Flag Chrome processes making network requests to newly registered or low-reputation domains shortly after extension installation
Review browser management console logs for policy overrides that permit sideloaded or developer-mode extensions

Monitoring Recommendations

Enable Chrome Enterprise reporting to stream extension telemetry and version data to a centralized log store
Alert on any Chrome instance running a version below the patched 152.0.7977.65 build
Correlate user-reported phishing incidents with recent extension activity on the same endpoint

How to Mitigate CVE-2026-79176

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all desktop endpoints
Audit installed extensions and remove any that are unsigned, sideloaded, or from untrusted publishers
Restrict extension installation to an administrator-approved allowlist using Chrome Enterprise policies
Communicate the risk to users and reinforce that legitimate credential prompts do not originate from unexpected extensions

Patch Information

Google addressed CVE-2026-79176 in the Chrome Stable channel release 152.0.7977.65. Details are available in the Chrome Stable Channel Update advisory. Enterprises using managed Chrome deployments should verify that automatic update channels are enabled and that endpoints have restarted the browser to apply the fix.

Workarounds

Disable all non-essential extensions until the browser is patched to the fixed version
Enforce the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies to limit extension installation to vetted publishers
Set ExtensionInstallSources to prevent installation from arbitrary URLs and require the Chrome Web Store as the source of truth

bash

# Example Chrome Enterprise policy (Windows registry) restricting extensions
# HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist
#   1 = "*"
# HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist
#   1 = "<approved-extension-id-1>"
#   2 = "<approved-extension-id-2>"