CVE-2026-79250: Google Chrome XSS Navigation Vulnerability

CVE-2026-79250 Overview

CVE-2026-79250 is a user interface (UI) misrepresentation vulnerability in the Navigation component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65 and allows a remote attacker to spoof the address bar via a crafted HTML page. Google classifies the Chromium security severity as Medium. The vulnerability is tracked as CWE-451: User Interface (UI) Misrepresentation of Critical Information.

Critical Impact
An attacker-controlled page can display a misleading URL in the Chrome address bar, enabling phishing and credential-harvesting scenarios that rely on user trust in the origin indicator.

Affected Products

Google Chrome for Desktop prior to version 152.0.7977.65
Chromium-based browsers that inherit the affected Navigation code path
Chrome Stable channel builds released before the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-79250 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79250

Vulnerability Analysis

The vulnerability resides in Chrome's Navigation component, which manages how the browser transitions between origins and updates the address bar. A crafted HTML page can drive the navigation logic into a state where the URL rendered in the omnibox does not match the origin actually serving the page content. This mismatch defeats the primary trust indicator that users rely on to verify a site's identity.

UI misrepresentation flaws of this class (CWE-451) are commonly leveraged in phishing operations. An attacker can host malicious content while the address bar displays a benign or trusted domain. Because the exploit requires only that a victim visit a page, the attack surface extends to any user who clicks a link, opens an email, or is redirected through malvertising.

According to Chromium security triage, this issue was rated Medium severity. Google addressed the flaw in the Chrome Stable channel update documented in the Chrome Releases blog.

Root Cause

The root cause is improper synchronization between the committed navigation state and the URL displayed to the user. Chromium tracks pending, provisional, and committed navigations separately. When a crafted page manipulates navigation timing or intermediate document states, the omnibox can render a URL from one navigation while document content originates from another. Additional technical detail is restricted in Chromium Issue Tracker #514006744 pending broad patch adoption.

Attack Vector

The attack vector is remote and network-based. An attacker hosts a crafted HTML page and lures the victim to visit it through a link, redirect, or embedded frame. No authentication or privileged access is required. The page executes navigation sequences designed to leave a spoofed URL in the address bar while attacker-controlled content is rendered. This enables convincing phishing pages, fake login prompts, and social engineering that abuses the perceived legitimacy of the displayed domain.

No public proof-of-concept exploit is available in ExploitDB, and CISA has not added CVE-2026-79250 to the Known Exploited Vulnerabilities catalog. The EPSS probability at publication is low.

Detection Methods for CVE-2026-79250

Indicators of Compromise

Outbound HTTPS connections from Chrome to newly registered or low-reputation domains immediately followed by credential submission events.
Phishing pages that visually mimic trusted brands while browser telemetry records a different loaded origin than the address bar suggests.
User reports of address bar URLs that do not match subsequent page behavior or certificate details.

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any installation below 152.0.7977.65.
Correlate browser process telemetry with DNS and proxy logs to identify navigation to suspicious domains that coincide with credential entry.
Monitor enterprise phishing reports for URL/origin mismatches, which can indicate active exploitation of address bar spoofing.

Monitoring Recommendations

Ingest Chrome version and update status into a centralized data lake to track patch compliance over time.
Alert on high volumes of user-reported phishing that reference visually trusted domains, and pivot to browser session telemetry.
Track navigation events from managed browsers using enterprise policies and forward logs to your SIEM for correlation.

How to Mitigate CVE-2026-79250

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after updating to ensure the patched Navigation component is active in all browser processes.
Verify enterprise deployment tools (Chrome Browser Cloud Management, Group Policy, MDM) enforce the minimum patched version.

Patch Information

Google released the fix in the Chrome Stable channel update announced on the Chrome Releases blog. Users should confirm they are running Chrome 152.0.7977.65 or later via chrome://settings/help. Chromium-based browser vendors (Edge, Brave, Opera, Vivaldi) should be monitored for downstream releases that incorporate the same fix.

Workarounds

Enforce automatic Chrome updates through enterprise policy to reduce exposure windows for browser vulnerabilities.
Deploy phishing-resistant authentication such as FIDO2/WebAuthn, which binds credentials to the true origin and neutralizes address bar spoofing.
Train users to verify TLS certificate details and site behavior rather than relying solely on the address bar when handling sensitive credentials.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version
# Expected output: Google Chrome 152.0.7977.65 or later

# Windows: check version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version