CVE-2026-79284: Google Chrome XSS Vulnerability

CVE-2026-79284 Overview

CVE-2026-79284 is a user interface (UI) misrepresentation vulnerability in the Core component of Google Chrome on macOS. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can use a crafted HTML page to spoof UI elements shown to the user. Google's Chromium team rates the underlying issue as Low severity, while NVD scores it as Medium. The weakness is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information.

Critical Impact
Successful exploitation lets an attacker spoof browser UI elements on macOS, enabling downstream phishing and social-engineering attacks against Chrome users who interact with a malicious page.

Affected Products

Google Chrome on macOS prior to 152.0.7977.65
Apple macOS (host platform for the vulnerable Chrome build)
Chromium Core component responsible for UI rendering

Discovery Timeline

2026-08-25 - CVE-2026-79284 published to NVD
2026-08-27 - Last updated in NVD database
2026-08 - Google releases Stable channel update fixing the issue (see Google Chrome Stable Update)

Technical Details for CVE-2026-79284

Vulnerability Analysis

The vulnerability lives in Chrome's Core UI rendering path on macOS. An attacker who has already compromised the renderer process can serve a crafted HTML page that manipulates how Chrome draws trusted UI chrome. Because the renderer influences what the user perceives as browser UI, the attacker can present misleading indicators such as address bar contents, dialogs, or origin markers. The impact is confined to integrity of UI information; confidentiality and availability are not affected. Exploitation requires user interaction with the malicious page, and the attacker must already control the renderer, which raises the practical barrier. The condition maps to CWE-451, where security-relevant information is misrepresented to the user.

Root Cause

The root cause is improper separation between renderer-controlled content and trusted browser UI on the macOS build of Chrome. A compromised renderer can influence UI drawing paths in ways that let attacker-controlled pixels overlap or imitate browser-owned indicators. Chromium's issue tracker entry #519210950 is restricted, consistent with Google's standard practice for undisclosed UI spoofing details.

Attack Vector

The attack proceeds in two stages. First, the attacker leverages a separate flaw or an already compromised renderer process. Second, the compromised renderer loads a crafted HTML page that triggers the UI misrepresentation. The victim must interact with the spoofed UI, for example by trusting a fake permission prompt, address bar, or origin indicator. Because the underlying vector is network-delivered HTML, any attacker-controlled or attacker-influenced page can serve as the delivery mechanism once renderer control is achieved.

No public proof-of-concept exploit is available for CVE-2026-79284. See the Chromium Issue Tracker entry and the Google Chrome Stable Update for vendor details.

Detection Methods for CVE-2026-79284

Indicators of Compromise

macOS endpoints running Google Chrome at a version earlier than 152.0.7977.65.
Chrome renderer processes exhibiting anomalous child-process behavior, crashes, or sandbox escape attempts that precede UI spoofing.
User reports of inconsistent address bar, permission prompt, or origin indicator behavior on specific web pages.

Detection Strategies

Inventory installed Chrome versions across macOS fleets and flag hosts below 152.0.7977.65.
Correlate browser telemetry with phishing and credential-theft alerts, since UI spoofing typically precedes credential capture.
Monitor for renderer-process compromise indicators, as this vulnerability requires prior renderer control to be useful.

Monitoring Recommendations

Ingest macOS process telemetry and Chrome update status into a central data lake for version-drift analysis.
Alert on Chrome renderer crashes clustered around the same origin, which can indicate exploitation attempts against the renderer.
Track outbound connections from Chrome to newly registered or low-reputation domains that host active HTML content.

How to Mitigate CVE-2026-79284

Immediate Actions Required

Update Google Chrome on all macOS endpoints to 152.0.7977.65 or later.
Restart Chrome after the update so the new binary and renderer sandbox are loaded.
Verify enterprise auto-update policies push the Stable channel build without user opt-out.

Patch Information

Google addressed CVE-2026-79284 in the Chrome Stable channel release for macOS at version 152.0.7977.65. Details are published in the Google Chrome Stable channel update. Administrators managing Chrome via MDM or Google Admin Console should confirm the deployed version reflects the fix.

Workarounds

Enforce enterprise policies that block execution of untrusted or unclassified web content until patching completes.
Train users to validate sensitive actions through out-of-band channels rather than trusting in-page UI cues.
Restrict browser extension installation and reduce renderer attack surface by disabling unused site permissions.

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force Chrome update check via MDM or manually
open -a "Google Chrome" --args --check-for-update-interval=1