CVE-2026-79274: Google Chrome GPU Information Disclosure

CVE-2026-79274 Overview

CVE-2026-79274 is an information disclosure vulnerability in the GPU component of Google Chrome prior to version 152.0.7977.65. A remote attacker can obtain cross-origin data by convincing a user to visit a crafted HTML page. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Chromium's internal security triage rates the underlying issue as High, while the assigned CVSS 3.1 base score is 4.3 (Medium) because exploitation requires user interaction and only affects confidentiality.

Critical Impact
Attackers can bypass the browser's same-origin policy through the GPU process and read data belonging to other origins, undermining a core web security boundary.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers that embed the vulnerable GPU code path
Downstream distributions shipping Chromium before the Stable channel update

Discovery Timeline

2026-08-25 - CVE-2026-79274 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79274

Vulnerability Analysis

The vulnerability resides in Chrome's GPU process, which handles hardware-accelerated rendering for WebGL, Canvas2D, WebGPU, and video decoding. A crafted HTML page can trigger a code path in the GPU process that returns pixel or buffer data derived from resources belonging to a different origin. This breaks the browser's cross-origin isolation guarantees. An attacker hosting a malicious page can read fragments of content the victim's browser rendered from other sites, including images, canvas data, or textures loaded from authenticated third-party origins.

The issue is tracked in Chromium Issue Tracker #543707066 and was fixed in the Chrome Stable channel update.

Root Cause

The root cause is improper enforcement of cross-origin boundaries within GPU-side resource handling, consistent with [CWE-200]. GPU command buffers or texture memory retained data from one origin that could be read back through operations initiated by another origin. Chromium restricts issue tracker details until a broad share of users has updated, so the specific subsystem, whether WebGL readback, Canvas taint tracking, or another surface, is not public.

Attack Vector

Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build. The malicious page issues GPU operations that reference or interact with resources from another origin and then reads back the resulting buffer. No privileges or authentication are required on the attacker's site. The vulnerability does not enable code execution or persistence by itself, but the leaked cross-origin data can include session-relevant content, authenticated resources, or material used to stage follow-on attacks.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-79274

Indicators of Compromise

Browser telemetry showing Chrome versions prior to 152.0.7977.65 still active in the environment after the patch release
Outbound requests from user endpoints to unfamiliar domains immediately following visits to untrusted pages hosting WebGL, WebGPU, or Canvas-heavy content
GPU process crashes or unusual renderer-to-GPU IPC volume correlated with visits to unknown origins

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions across managed endpoints and flag any build older than 152.0.7977.65
Correlate web proxy logs with endpoint browser versions to identify vulnerable clients visiting uncategorized or newly registered domains
Alert on repeated navigation to pages that heavily exercise GPU APIs from hosts not previously seen in the environment

Monitoring Recommendations

Ingest browser version and update status into the endpoint security data lake for continuous compliance reporting
Monitor DNS and HTTP telemetry for exfiltration patterns following renderer activity, since the leaked data must be transmitted back to the attacker
Track user reports of unexpected content, rendering glitches, or GPU driver instability that could indicate exploitation attempts

How to Mitigate CVE-2026-79274

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Force a managed browser restart to ensure the updated binary is loaded, since Chrome only completes updates on relaunch
Update Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi as their vendors ship the corresponding fix

Patch Information

Google released the fix in the Chrome Stable channel update announced at the Chrome Releases blog. Users on 152.0.7977.65 or later are no longer exposed. Enterprises using Chrome Browser Cloud Management or group policy should confirm the TargetVersionPrefix or update policy does not pin devices to an older build.

Workarounds

Restrict browsing to trusted sites through web filtering while patch deployment is in progress
Disable hardware acceleration in Chrome as a temporary control, accepting the performance impact, since the flaw resides in the GPU process
Apply site isolation and strict third-party cookie policies through enterprise policy to reduce the value of any leaked cross-origin data

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Temporary mitigation: launch Chrome with hardware acceleration disabled
google-chrome --disable-gpu