CVE-2026-79252: Chrome ServiceWorker Information Leak

CVE-2026-79252 Overview

CVE-2026-79252 is an information disclosure vulnerability in the ServiceWorker component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can exploit this flaw by serving a crafted HTML page to a targeted user. Successful exploitation allows the attacker to obtain cross-origin data that should be isolated by the browser's same-origin policy. The Chromium project rated the security severity as Medium. The weakness is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote attackers can leak cross-origin data through a crafted HTML page rendered by an unpatched Chrome browser, undermining web origin isolation guarantees.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers using the affected ServiceWorker implementation
Downstream Chromium distributions that had not yet integrated the fix at disclosure

Discovery Timeline

2026-08-25 - CVE-2026-79252 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79252

Vulnerability Analysis

The vulnerability resides in Chrome's ServiceWorker implementation. ServiceWorkers are background scripts that intercept and handle network requests for web origins, enabling offline functionality and caching. The flaw permits data belonging to one origin to be observed by another origin through the ServiceWorker pathway. This breaks the browser's cross-origin isolation model, which normally prevents scripts from reading responses or state from unrelated origins. Because the ServiceWorker sits between the page and the network, a mishandled request or response boundary can expose sensitive data such as response bodies, headers, or navigation state to an attacker-controlled context.

Root Cause

The root cause is improper enforcement of cross-origin boundaries within the ServiceWorker request or response handling path. Consult Chromium Issue #524541667 for the authoritative technical description once the issue is unrestricted.

Attack Vector

Exploitation requires a victim to visit a crafted HTML page under attacker control or influence. The attack executes over the network and requires user interaction, but no authentication or elevated privileges. The attacker leverages ServiceWorker registration and interception behavior to observe data from a different origin than the one that served the page. No verified public exploit code is available for this issue at time of writing.

Detection Methods for CVE-2026-79252

Indicators of Compromise

Unexpected ServiceWorker registrations from unfamiliar or newly observed domains in browser telemetry.
Outbound HTTPS traffic to attacker-controlled infrastructure immediately following user visits to untrusted pages.
Browser version strings in user-agent telemetry showing Chrome builds older than 152.0.7977.65.

Detection Strategies

Inventory browser versions across the fleet and flag endpoints running Chrome earlier than 152.0.7977.65.
Correlate web proxy logs with known-malicious domains that host crafted HTML pages targeting Chromium ServiceWorker flaws.
Monitor endpoint process telemetry for Chrome renderer crashes or anomalous child process activity following visits to untrusted origins.

Monitoring Recommendations

Ingest browser version and extension inventory into a centralized data lake for continuous version-drift analysis.
Alert on ServiceWorker registration events originating from low-reputation domains via secure web gateway logs.
Track user navigation patterns to newly registered or typo-squatted domains that could deliver crafted HTML payloads.

How to Mitigate CVE-2026-79252

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Force-restart Chrome after the update so the patched binary is loaded into memory.
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding upstream fixes as vendors release them.

Patch Information

Google addressed CVE-2026-79252 in Chrome 152.0.7977.65 on the Stable channel for Desktop. Refer to the Google Chrome Desktop Update advisory for release details and channel information. Enterprise administrators should validate deployment through Chrome Browser Cloud Management or their existing patch management tooling.

Workarounds

Restrict user browsing to trusted origins via secure web gateway policy until the patch is deployed.
Disable ServiceWorker functionality through enterprise policy where business workflows permit, using the URLBlocklist or feature-specific Chrome policies.
Encourage users to avoid clicking untrusted links and to close Chrome sessions after visiting unknown sites until updates are applied.

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows registry query for installed Chrome version
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv