CVE-2026-79246: Chrome DataTransfer Information Disclosure

CVE-2026-79246 Overview

CVE-2026-79246 is an information disclosure vulnerability in the DataTransfer component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can obtain sensitive information from a target browser by luring a user to a crafted HTML page. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Chromium's internal severity assessment classifies the issue as Low, while the NVD assigns a higher score based on the confidentiality impact. Exploitation requires user interaction but no privileges or authentication.

Critical Impact
A remote attacker can exfiltrate sensitive data from the browser via DataTransfer when a user visits a malicious HTML page.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers that embed the vulnerable DataTransfer implementation
Downstream distributions bundling pre-patch Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79246 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79246

Vulnerability Analysis

The vulnerability resides in Chrome's DataTransfer interface, which mediates data exchange during drag-and-drop and clipboard operations across web pages. Improper handling within this interface allows a crafted HTML page to read data that should be isolated from the attacker's origin. The result is unauthorized disclosure of sensitive information held by the browser or the user's active session. The Chromium project addressed the defect in Chrome 152.0.7977.65 on the stable channel.

Root Cause

The root cause is an information exposure weakness [CWE-200] within the DataTransfer object handling logic. The implementation fails to enforce the isolation boundaries expected between origins during data transfer events. Attacker-controlled JavaScript in a hostile page can observe or extract content that the same-origin policy is supposed to protect. Public patch notes describe the defect as an information leak without disclosing the internal call paths involved.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page and induces the victim to visit it, typically through phishing, malvertising, or a compromised site. When the page loads or when the user performs an expected interaction such as a drag, focus change, or paste, the malicious script queries the DataTransfer object to harvest data. No authentication and no elevated privileges are required on the target system. See the Chromium Issue Tracker entry for the tracked defect and the Google Chrome Stable Update announcement for release context.

Detection Methods for CVE-2026-79246

Indicators of Compromise

User-agent strings reporting Chrome or Chromium builds older than 152.0.7977.65 after the patch release date.
Outbound HTTP POST requests containing base64-encoded or JSON-wrapped payloads that appear to reflect clipboard or drag content.
DNS queries or HTTPS connections from browser processes to newly registered or low-reputation domains immediately after a user interaction event.

Detection Strategies

Inventory endpoint browser versions and flag any Chrome installation below 152.0.7977.65 for remediation.
Correlate browser process telemetry with unexpected network egress that follows drag, drop, or paste events on unfamiliar pages.
Use web filtering logs to identify visits to domains hosting HTML that references DataTransfer APIs from suspicious sources.

Monitoring Recommendations

Ingest browser version data into your asset inventory to track patch compliance across the fleet.
Monitor DNS and proxy logs for beaconing from Chrome processes after visits to untrusted origins.
Alert on newly observed domains delivering HTML content immediately following email clicks or ad redirects.

How to Mitigate CVE-2026-79246

Immediate Actions Required

Update all Google Chrome installations to version 152.0.7977.65 or later on Windows, macOS, and Linux.
Restart the browser after applying the update so the patched binary is loaded into memory.
Push the update to managed endpoints through enterprise policy or software distribution tooling.

Patch Information

Google released the fix in the Chrome stable channel update announced on the Chrome Releases blog. Users on the stable channel should upgrade to 152.0.7977.65 or newer. Chromium-based browsers should adopt the corresponding upstream fix from the Chromium Issue Tracker once vendors publish their builds.

Workarounds

Restrict access to untrusted websites through enterprise web filtering until patching is complete.
Enforce Chrome auto-update policies so future stable channel releases install without user action.
Educate users to avoid interacting with unsolicited links delivered through email or messaging platforms.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Enterprise policy snippet to enforce auto-update on managed Chrome deployments
# /etc/opt/chrome/policies/managed/update_policy.json
{
  "DefaultBrowserSettingEnabled": true,
  "ComponentUpdatesEnabled": true,
  "UpdatePolicyOverride": 1
}