CVE-2026-79196: Google Chrome Race Condition Vulnerability

CVE-2026-79196 Overview

CVE-2026-79196 is a race condition vulnerability in the Editing component of Google Chrome versions prior to 152.0.7977.65. The flaw allows a remote attacker to obtain sensitive information by convincing a user to visit a crafted HTML page. Exploitation requires user interaction and leverages social engineering, which increases attack complexity. Google's Chromium project classified the internal security severity as Low, while the NVD assigned a medium CVSS rating driven by the confidentiality impact. The issue is tracked in Chromium as Issue #502252964 and was disclosed in the Stable Channel Update for Desktop.

Critical Impact
Successful exploitation can disclose sensitive in-browser data when a user visits an attacker-controlled page.

Affected Products

Google Chrome versions prior to 152.0.7977.65 (Desktop, Stable Channel)
Chromium-based browsers incorporating vulnerable Editing component code
All supported desktop platforms shipping the affected Chrome build

Discovery Timeline

2026-08-25 - CVE-2026-79196 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79196

Vulnerability Analysis

The vulnerability is a race condition [CWE-367: Time-of-check Time-of-use (TOCTOU)] within Chrome's Editing subsystem. This component handles content-editable regions, text selection, clipboard interaction, and DOM mutation during user edits. When two concurrent operations interleave without proper synchronization, an attacker can observe intermediate state that should not be exposed to script running in the page.

An attacker leveraging this timing window can read data that crosses trust boundaries within the renderer process. Because the flaw resides in Editing rather than the sandbox or IPC layer, disclosure is limited to information accessible during the editing operation. The vulnerability does not allow code execution or integrity impact, consistent with the confidentiality-only classification in the CVSS vector.

Root Cause

The root cause is missing or insufficient synchronization between check and use operations on state managed by the Editing component. During DOM edits, Chrome performs validation on selection ranges or node state before applying a mutation. A concurrent operation, driven from attacker script, can alter that state between the check and the subsequent use, causing the browser to operate on unintended data.

Attack Vector

Exploitation requires a user to visit a crafted HTML page delivered through phishing, malvertising, or a compromised site. The attacker page uses JavaScript to trigger editing operations while simultaneously mutating the DOM or selection to win the race. High attack complexity reflects the timing precision required to reliably observe the leaked data.

No verified proof-of-concept has been published. Technical mechanics are described in the Chromium Issue Tracker, though access may be restricted until the disclosure window closes.

Detection Methods for CVE-2026-79196

Indicators of Compromise

Browser telemetry showing Chrome desktop versions below 152.0.7977.65 in the environment.
Web proxy logs showing user navigation to unfamiliar domains immediately preceded by targeted email or chat links.
Anomalous outbound POST requests from browser sessions containing text fragments that resemble internal document content.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 152.0.7977.65.
Alert on user reports of unexpected content pasted or edited in web forms shortly after clicking untrusted links.
Correlate phishing email delivery with subsequent navigation to newly registered or low-reputation domains.

Monitoring Recommendations

Enable enterprise browser reporting to centralize version, extension, and navigation telemetry.
Monitor DNS and HTTP logs for access to typosquat or newly seen domains referenced in phishing campaigns.
Track Chrome auto-update health to ensure endpoints receive stable channel patches without delay.

How to Mitigate CVE-2026-79196

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all desktop endpoints.
Force browser restart after update deployment to ensure the patched binary is loaded.
Reinforce user awareness that this class of issue requires visiting a crafted page, making phishing hygiene the primary defensive layer.

Patch Information

Google released the fix in the Chrome Stable Channel update announced in the Chrome Releases blog. Enterprises using managed Chrome deployments should verify the TargetVersionPrefix policy permits the fixed build and that RelaunchNotification is enforced to guarantee timely restart.

Workarounds

No vendor-supplied workaround exists; applying the Chrome update is the only supported remediation.
Restrict browsing on high-value workstations to allow-listed domains until patching completes.
Deploy phishing-resistant email filtering to reduce the likelihood of users reaching a crafted HTML page.

bash

# Verify installed Chrome version on Windows managed endpoints
reg query "HKLM\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version