CVE-2026-79185: Google Chrome DOM Information Disclosure

CVE-2026-79185 Overview

CVE-2026-79185 is an information disclosure vulnerability in the Document Object Model (DOM) implementation of Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to bypass the web origin policy by serving a crafted HTML page. Google's Chromium team classified the security severity as Medium. The flaw maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Successful exploitation lets an attacker-controlled origin read data that same-origin protections should isolate, undermining a core browser security boundary.

Critical Impact
A crafted HTML page can bypass Chrome's web origin policy and leak cross-origin DOM data to a remote attacker.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable DOM code path
Embedded WebView or CEF distributions built on pre-152 Chromium

Discovery Timeline

2026-08-25 - CVE-2026-79185 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79185

Vulnerability Analysis

The issue exists in Chrome's DOM subsystem, which mediates how scripts read and manipulate document content across frames and origins. A logic flaw permits an attacker page to observe data that the same-origin policy is designed to isolate. Because the DOM is reachable from any HTML page, exploitation requires only that a victim load an attacker-controlled URL or an attacker-controlled iframe embedded in a legitimate site.

The vulnerability does not appear to grant code execution. Instead, it exposes cross-origin state such as document properties, resource metadata, or rendered content. That state can include authenticated session context, personal data displayed in another tab, or tokens embedded in third-party pages. Chromium's own advisory rates the flaw Medium rather than High, consistent with an information disclosure rather than a memory safety defect.

Root Cause

Information leaks classified under [CWE-200] in the DOM typically arise from missing origin checks, cross-origin side effects during layout or scripting, or improper handling of attributes exposed to JavaScript. The Chromium Issue Tracker #536526176 records the fix. Public technical detail is withheld until users update, following Chrome's standard disclosure practice.

Attack Vector

Exploitation is remote and network-based. An attacker hosts a crafted HTML page or injects content into a site the victim already trusts, for example through a compromised ad, comment field, or embedded iframe. When the browser renders the page, attacker-controlled JavaScript triggers the leaking DOM path and reads data from another origin. No authentication is required, and user interaction is limited to navigating to a page. See the Google Chrome Stable Update announcement for the release notes.

Detection Methods for CVE-2026-79185

Indicators of Compromise

Chrome browser processes at versions below 152.0.7977.65 on managed endpoints.
Outbound HTTP(S) requests to unfamiliar domains immediately after users visit third-party embedded content.
Unexpected cross-origin fetch, postMessage, or Beacon traffic originating from tabs rendering untrusted iframes.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build older than 152.0.7977.65.
Correlate browser telemetry with proxy logs to identify pages that trigger anomalous cross-origin data flows.
Monitor for suspicious HTML content patterns hosted on user-generated content platforms that could deliver the crafted payload.

Monitoring Recommendations

Enforce Chrome update policy through group policy or MDM and alert when clients report a stale version.
Route browser traffic through a secure web gateway capable of inspecting JavaScript for known exploit signatures once details are published.
Track browser process telemetry and network egress from endpoint detection tooling to surface data exfiltration attempts.

How to Mitigate CVE-2026-79185

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update installs so the patched binaries are actually loaded.
Update Chromium-based browsers and embedded WebView components to a build that incorporates the fix.

Patch Information

Google addressed the vulnerability in Chrome Stable 152.0.7977.65. Consult the Google Chrome Stable Update announcement for the full changelog and the Chromium Issue Tracker #536526176 for the underlying bug reference. Enterprise administrators should push the update through Chrome Browser Cloud Management, Group Policy, or their MDM of choice.

Workarounds

Restrict browsing to trusted sites through URL filtering until the update is deployed.
Disable or restrict third-party iframes and cross-origin embedding for high-risk user populations using enterprise policies.
Encourage users to run Chrome with chrome://settings/help open to force an update check on session start.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query the registry for the installed Chrome build
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enterprise: force update via Chrome Browser Cloud Management policy
# Set TargetVersionPrefix to 152.0.7977.65