CVE-2026-79207 Overview
CVE-2026-79207 is an information disclosure vulnerability in the Passwords component of Google Chrome on iOS. Versions prior to 152.0.7977.65 are affected. A local attacker can obtain sensitive information by delivering a crafted file to a user. Chromium classifies the underlying security severity as Low, while the NVD assigns a medium rating driven by network attack vector with user interaction. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Successful exploitation exposes sensitive password-related data stored or handled by Chrome for iOS, undermining credential confidentiality on affected devices.
Affected Products
- Google Chrome for iOS versions prior to 152.0.7977.65
- Apple iOS devices running vulnerable Chrome builds
- Chromium-based password handling on iOS
Discovery Timeline
- 2026-08-25 - CVE-2026-79207 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79207
Vulnerability Analysis
The vulnerability resides in the Passwords component of Google Chrome on iOS. Chrome's password subsystem manages credential storage, autofill, and synchronization with the user's Google account. Improper handling of a crafted file allows an attacker with local file delivery capability to read information that should remain isolated to the browser process. The disclosed data can support follow-on credential theft, account takeover, or targeted phishing. The flaw impacts confidentiality only; integrity and availability of the browser are not affected. Google addressed the issue in the Chrome Stable channel update tracked in Chromium Issue #533014006.
Root Cause
The root cause maps to CWE-200, where the Passwords component exposes sensitive information to an unauthorized actor. Insufficient validation or sandboxing when parsing a crafted file allows attacker-controlled input to trigger disclosure of protected content held by Chrome on iOS.
Attack Vector
Exploitation requires the victim to open or process a crafted file within Chrome on iOS. User interaction is required, and no privileges are needed on the target. Delivery vectors include phishing links, malicious downloads, or shared file attachments. Once the crafted file is processed, the attacker gains access to sensitive password-adjacent information without executing additional code.
No public proof-of-concept exploit is available. See the Google Chrome Stable Update advisory and Chromium Issue #533014006 for vendor-controlled technical detail.
Detection Methods for CVE-2026-79207
Indicators of Compromise
- Chrome for iOS installations reporting a version earlier than 152.0.7977.65 in mobile device management (MDM) inventory.
- Delivery of unexpected file attachments or download prompts targeted at iOS users of Chrome.
- Unusual outbound traffic from iOS endpoints shortly after a user opens an unfamiliar file in Chrome.
Detection Strategies
- Query MDM and endpoint inventory for Chrome iOS versions and flag any build below 152.0.7977.65.
- Correlate email and messaging telemetry with mobile browser file-open events to identify suspicious file delivery.
- Monitor for anomalous credential use following mobile browsing sessions, which may indicate downstream exploitation of leaked data.
Monitoring Recommendations
- Track Google Chrome release notes and Chromium issue tracker entries for reintroductions or related regressions.
- Alert on authentication anomalies for accounts whose passwords are managed through Chrome on iOS.
- Ingest mobile browser telemetry into a central data lake to enable retroactive hunting once new indicators emerge.
How to Mitigate CVE-2026-79207
Immediate Actions Required
- Update Google Chrome on iOS to version 152.0.7977.65 or later through the Apple App Store.
- Enforce the minimum Chrome version through MDM policy on managed iOS devices.
- Instruct users to avoid opening unsolicited files in Chrome on iOS until updates are applied.
Patch Information
Google released the fix in the Chrome Stable channel. Details are published in the Google Chrome Stable Update advisory and the corresponding Chromium Issue #533014006. Upgrading to Chrome 152.0.7977.65 or later on iOS remediates the vulnerability.
Workarounds
- Use an alternate browser on iOS for handling untrusted files until the Chrome update is deployed.
- Disable Chrome password autofill on iOS to reduce exposure of stored credentials during the patch window.
- Restrict inbound file delivery from untrusted sources at the email and messaging gateway.
# Verify installed Chrome version on managed iOS devices via MDM query
# Example: Jamf Pro Smart Group criterion
Application Title is "Google Chrome"
AND Application Version is less than "152.0.7977.65"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
