CVE-2026-79220: Google Chrome Information Disclosure Flaw

CVE-2026-79220 Overview

CVE-2026-79220 is an information disclosure vulnerability in the Network component of Google Chrome. Versions prior to Chrome 152.0.7977.65 are affected. A remote attacker who has already compromised the renderer process can obtain sensitive information by serving a crafted HTML page to the victim. Google classifies the Chromium security severity as Medium and maps the issue to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
An attacker with renderer-level control can leak sensitive data across security boundaries in Chrome, weakening the browser's site isolation guarantees and enabling follow-on attacks.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based builds incorporating the vulnerable Network component
Downstream browsers that inherit the affected Chromium networking stack

Discovery Timeline

2026-08-25 - CVE-2026-79220 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in the NVD database

Technical Details for CVE-2026-79220

Vulnerability Analysis

The flaw resides in Chrome's Network component, which handles HTTP, cache, and cross-origin data flow between the browser process and sandboxed renderers. Under normal operation, the Network service enforces isolation so a renderer only sees resources it is authorized to access. This vulnerability breaks that assumption when the renderer has already been compromised.

Exploitation requires two conditions. First, the attacker must control the renderer process, typically through a prior remote code execution or sandbox-relevant bug. Second, the victim must interact with a crafted HTML page. High attack complexity reflects the multi-stage exploitation chain rather than the simplicity of the leak itself.

The outcome is disclosure of sensitive information handled by the networking layer. This can include response data, headers, or cached content that should remain scoped to another origin. The issue does not permit code execution or integrity impact on its own but is valuable as a chained primitive.

Root Cause

The root cause is improper information exposure ([CWE-200]) in Chrome's Network component. The component fails to fully constrain data access requested by a compromised renderer, allowing that renderer to read information beyond its intended origin boundary.

Attack Vector

The attack is network-based and requires user interaction. The victim must load attacker-controlled HTML in a browser whose renderer the attacker has previously compromised. No specific technical exploit code has been published; refer to the Chromium Issue Tracker Entry and the Chrome Release Update for details.

Detection Methods for CVE-2026-79220

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 in enterprise inventory
Renderer processes making unexpected cross-origin fetches or reading unusual cache entries
Outbound connections from browser hosts to newly registered or low-reputation domains hosting crafted HTML payloads

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65.
Correlate browser telemetry with proxy and DNS logs to identify renderers loading suspicious HTML resources.
Hunt for artifacts of a prior renderer compromise, such as anomalous child processes spawned by chrome.exe or unusual memory allocations, since renderer control is a prerequisite.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a central data lake to correlate renderer behavior with network egress.
Monitor for exfiltration patterns such as bursts of small POST requests originating from browser processes.
Track Chrome auto-update status through management tooling to confirm patch propagation across the fleet.

How to Mitigate CVE-2026-79220

Immediate Actions Required

Update all Google Chrome installations to version 152.0.7977.65 or later immediately.
Verify that Chrome auto-update is enabled and functioning on managed endpoints.
Audit browser extensions and remove any that expand renderer attack surface without a business justification.

Patch Information

Google addressed the vulnerability in Chrome Stable 152.0.7977.65. Details are available in the Chrome Release Update. Chromium-based browsers should adopt the corresponding upstream fix once vendors rebase.

Workarounds

Enforce strict site isolation and disable legacy content settings that weaken cross-origin restrictions.
Apply enterprise policy to block execution of untrusted HTML content, for example through URL allowlists and Safe Browsing enhanced protection.
Restrict browsing on high-value hosts to a curated set of business-critical domains until patching completes.

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version