CVE-2026-79179: Google Chrome DOM Information Disclosure

CVE-2026-79179 Overview

CVE-2026-79179 is an incorrect authorization vulnerability [CWE-863] in the Document Object Model (DOM) implementation of Google Chrome prior to version 152.0.7977.65. A remote attacker can leak sensitive information by convincing a user to visit a crafted HTML page. The flaw allows cross-origin data exposure through improper authorization checks within DOM operations. Google's Chromium security team rated the underlying issue as Low severity, while the National Vulnerability Database (NVD) assigned a higher CVSS score reflecting confidentiality impact over the network. User interaction is required for exploitation.

Critical Impact
A remote attacker can exfiltrate confidential browser data from a targeted user by luring them to a malicious web page rendered by an unpatched Chrome build.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers embedding vulnerable Blink/DOM code prior to the 152 stable channel
Downstream distributions synchronizing with Chromium 152 (Edge, Brave, Opera, Vivaldi) until they ship equivalent fixes

Discovery Timeline

2026-08-25 - CVE-2026-79179 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79179

Vulnerability Analysis

The vulnerability originates in Chrome's DOM authorization logic. Chrome enforces the same-origin policy to prevent one document from reading data belonging to another origin. This flaw represents a failure of that enforcement inside a DOM code path, allowing a crafted page to reach information the requesting origin should not access.

Exploitation requires the victim to load an attacker-controlled HTML page. Once loaded, embedded scripts or DOM constructs bypass the missing authorization check and read sensitive data from the browsing context. Because the attack executes entirely in the rendering pipeline, no additional privileges are required on the target system.

The issue is tracked in Chromium Issue Tracker #533079345 and disclosed alongside the Google Chrome Stable Update. The Exploit Prediction Scoring System (EPSS) score is 0.211%, and no public proof of concept or in-the-wild exploitation has been reported.

Root Cause

The root cause is an incorrect authorization check [CWE-863] within a DOM operation. Code paths that access cross-origin or otherwise restricted resources fail to consistently verify that the calling context is authorized. The check that should gate access is either missing, evaluated against the wrong subject, or bypassable through a specific sequence of DOM interactions.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page and directs targets to it through phishing, malvertising, or a compromised site. When the victim visits the page in an unpatched Chrome build, embedded logic triggers the vulnerable DOM path and reads sensitive information. The attacker then exfiltrates the data through standard web channels such as an outbound fetch or image beacon.

No verified public exploit code exists at the time of publication. Refer to the Chromium Issue Tracker entry for technical details once Google releases the restricted bug report.

Detection Methods for CVE-2026-79179

Indicators of Compromise

Chrome browser processes on version strings earlier than 152.0.7977.65 connecting to newly registered or low-reputation domains.
Outbound HTTP POST or fetch traffic from browser processes carrying base64-encoded payloads immediately after a user navigates to an untrusted site.
Repeated navigation events to identical attacker-controlled URLs across multiple users in the same environment.

Detection Strategies

Inventory Chrome and Chromium-derivative version numbers across managed endpoints and flag any host below 152.0.7977.65.
Correlate browser process telemetry with DNS and proxy logs to identify sessions that render pages from suspicious origins.
Alert on browser child processes writing to unusual outbound sockets shortly after loading external HTML content.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake to establish a baseline for normal Chrome network behavior.
Monitor enterprise DNS resolvers for lookups to domains referenced in threat intelligence feeds covering Chromium exploit campaigns.
Track patch compliance dashboards to confirm rollout of Chrome 152.0.7977.65 or later across all endpoints.

How to Mitigate CVE-2026-79179

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Force a browser restart through management tooling to ensure the updated binaries load into memory.
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the upstream fix.

Patch Information

Google addressed the vulnerability in the Chrome stable channel release documented in the Google Chrome Stable Update. Chrome's built-in updater delivers 152.0.7977.65 automatically, but enterprise environments using policies such as TargetVersionPrefix or delayed rollouts should verify installation. Users can confirm the version by navigating to chrome://settings/help.

Workarounds

Restrict browsing to trusted domains through enterprise web filtering until patches are confirmed on every endpoint.
Disable or sandbox untrusted browser extensions that render third-party HTML content within privileged contexts.
Educate users to avoid links from unsolicited email or messaging while patch deployment is in progress.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# macOS: read the CFBundleShortVersionString
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString