CVE-2026-79204: Google Chrome UI Misrepresentation Vulnerability

CVE-2026-79204 Overview

CVE-2026-79204 is a user interface (UI) misrepresentation vulnerability in the Input component of Google Chrome on macOS. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can spoof UI elements by serving a crafted HTML page to a victim. Google's Chromium security team assigned the issue a Medium severity rating. The vulnerability is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information.

Critical Impact
A remote attacker can present misleading or spoofed UI content to Chrome users on macOS, enabling phishing and social-engineering attacks against users who trust browser-rendered indicators.

Affected Products

Google Chrome on macOS versions prior to 152.0.7977.65
Chromium-based components sharing the affected Input handling code
Downstream Chromium browsers on macOS that had not yet integrated the fix

Discovery Timeline

2026-08-25 - CVE-2026-79204 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database
2026-08-25 - Google released the Stable Channel Update for Desktop containing the fix

Technical Details for CVE-2026-79204

Vulnerability Analysis

The vulnerability resides in the Input component of Chrome on macOS. It is classified as a UI misrepresentation issue [CWE-451]. An attacker delivers a crafted HTML page that manipulates how Chrome renders input-related UI elements. The result is that browser-rendered indicators no longer accurately reflect the underlying page state or origin.

Because the flaw affects visual trust surfaces rather than memory safety, exploitation does not yield code execution. Instead, it undermines the user's ability to distinguish legitimate content from attacker-controlled content. This class of flaw commonly enables convincing phishing pages, fake permission prompts, or misleading input dialogs.

The EPSS model estimates a low near-term exploitation probability, and no public proof-of-concept is currently listed. However, UI spoofing bugs are frequently chained with credential-harvesting infrastructure once technical details become public.

Root Cause

The root cause is improper handling of visual state within the Input component's rendering path on macOS. Chrome fails to correctly represent input UI elements when the page is constructed with specific attacker-controlled markup. This allows the visible UI to diverge from the actual security context of the page.

Attack Vector

Exploitation is remote and requires user interaction. A victim must visit or be redirected to an attacker-controlled page. The crafted HTML causes Chrome to render input UI in a way that misleads the user about origin, focus, or the destination of typed input. No authentication is required, and no special privileges are needed on the target system.

No verified exploit code is publicly available. See the Chromium Issue Tracker entry #514069975 for the upstream report (access may be restricted until embargo lifts).

Detection Methods for CVE-2026-79204

Indicators of Compromise

Chrome installations on macOS reporting a version string earlier than 152.0.7977.65 in chrome://version.
User reports of unexpected input focus, unexplained overlays, or mismatched address bar content on specific sites.
Web proxy logs showing navigation to newly registered domains hosting HTML pages that mimic legitimate login or payment flows.

Detection Strategies

Inventory macOS endpoints and compare installed Chrome versions against the fixed release 152.0.7977.65 or later.
Correlate browser telemetry with phishing-related URL categories and DNS lookups to newly observed domains.
Review user-reported phishing submissions for pages that specifically target Chrome on macOS with unusual input handling.

Monitoring Recommendations

Monitor endpoint management data for Chrome update compliance across the macOS fleet.
Alert on credential-submission events to domains outside approved allowlists.
Track user-reported UI anomalies in Chrome and cross-reference with threat intelligence feeds covering phishing kits.

How to Mitigate CVE-2026-79204

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 152.0.7977.65 or later.
Enable automatic Chrome updates through mobile device management (MDM) or configuration profiles.
Communicate phishing awareness guidance to users, focusing on verifying URLs before entering credentials.

Patch Information

Google addressed CVE-2026-79204 in the Chrome Stable channel release documented in the Google Chrome Stable Update announcement. macOS users must upgrade to Chrome 152.0.7977.65 or newer. Chromium-based browsers should apply the corresponding upstream fix once their vendors integrate it.

Workarounds

Restrict browsing to trusted sites via enterprise web filtering until patched Chrome is deployed.
Deploy browser policies that disable rendering features associated with the affected Input paths where operationally feasible.
Encourage use of hardware-backed FIDO2 authenticators, which bind credentials to origin and resist UI spoofing.

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force update via Google Software Update on macOS
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot