CVE-2026-79208: Google Chrome HTTP2 Information Disclosure

CVE-2026-79208 Overview

CVE-2026-79208 is a missing authorization vulnerability in the HTTP/2 implementation of Google Chrome versions prior to 152.0.7977.65. A remote attacker can leak sensitive information by sending crafted network traffic to a vulnerable browser. The flaw is tracked under CWE-862: Missing Authorization and carries a Chromium security severity of Medium. Successful exploitation compromises confidentiality without requiring user interaction or authentication, though attack complexity is high. Google addressed the issue in the Stable channel update for desktop.

Critical Impact
Remote attackers can leak sensitive information from Chrome via crafted HTTP/2 traffic without user interaction.

Affected Products

Google Chrome versions prior to 152.0.7977.65 (Desktop)
Chromium-based browsers using the affected HTTP/2 stack
All operating systems running the vulnerable Chrome build (Windows, macOS, Linux)

Discovery Timeline

2026-08-25 - CVE-2026-79208 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79208

Vulnerability Analysis

The vulnerability resides in Chrome's HTTP/2 protocol implementation. HTTP/2 introduces multiplexed streams, header compression via HPACK, and server push, all of which require strict authorization checks between streams and connections. Missing authorization in this code path allows a remote attacker to observe data that should be scoped to another origin or stream context. The result is disclosure of sensitive information such as response headers, cookies, or cached content fragments.

Exploitation requires the victim browser to establish an HTTP/2 connection with an attacker-controlled or attacker-influenced endpoint. The high attack complexity reflects timing, sequencing, or protocol state conditions that must be met for the leak to succeed.

Root Cause

The root cause is an absent authorization check ([CWE-862]) within the HTTP/2 handling logic. Chrome fails to verify that the requesting context is authorized to access specific protocol-level resources or state before returning data. This allows cross-context observation of information that should remain isolated per stream or origin.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction beyond visiting or being redirected to attacker-controlled content. An attacker crafts HTTP/2 frames that manipulate stream state to elicit responses containing sensitive information from other browsing contexts. No verified public exploit or proof-of-concept has been released. See the Chromium Issue Tracker #513287677 for restricted technical details.

Detection Methods for CVE-2026-79208

Indicators of Compromise

Chrome browser processes still reporting versions earlier than 152.0.7977.65 after the patch release date
Outbound HTTP/2 connections to unfamiliar or newly registered domains showing anomalous stream volume
Unexpected HTTP/2 RST_STREAM or GOAWAY patterns paired with repeated stream initiation from the browser

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds below 152.0.7977.65
Correlate browser process telemetry with network logs to identify HTTP/2 sessions with unusual header or frame patterns
Alert on user agents reporting outdated Chrome versions when interacting with sensitive internal web applications

Monitoring Recommendations

Continuously monitor endpoint software inventory for outdated Chromium-based browsers
Ingest browser and network telemetry into a centralized data lake for cross-source correlation
Track access to sensitive internal URLs from browsers reporting pre-patch Chrome versions

How to Mitigate CVE-2026-79208

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force a browser restart to ensure the patched binary is loaded into memory
Audit third-party Chromium-based browsers and apply vendor updates that incorporate the upstream fix
Restrict access to sensitive internal applications from browsers reporting pre-patch versions

Patch Information

Google released the fix in the Stable channel update covering Chrome 152.0.7977.65 for desktop. Refer to the Google Chrome Stable Update advisory for release details. Enterprise administrators should deploy the update through managed browser channels or endpoint management tooling.

Workarounds

No official workaround exists; upgrading to the patched version is the required remediation
Where immediate patching is not possible, limit browsing of untrusted sites and enforce network egress filtering
Consider disabling HTTP/2 negotiation on high-risk internal proxies as a temporary defense-in-depth measure

bash

# Verify installed Chrome version on Windows, macOS, and Linux
# Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Expected output: 152.0.7977.65 or later