CVE-2026-79291 Overview
CVE-2026-79291 is an information disclosure vulnerability in the Cascading Style Sheets (CSS) implementation of Google Chrome prior to version 152.0.7977.65. A remote attacker can obtain sensitive information from the browser by delivering a crafted HTML page to a victim. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and was rated Medium severity by the Chromium security team. Exploitation requires user interaction, such as visiting an attacker-controlled web page or viewing malicious content embedded in a compromised site.
Critical Impact
A remote attacker can leak sensitive browser-side information from users who load a crafted HTML page, enabling reconnaissance for follow-on attacks.
Affected Products
- Google Chrome for Desktop versions prior to 152.0.7977.65
- Chromium-based browsers that incorporate the vulnerable CSS engine code
- Any downstream product embedding an unpatched Chromium build
Discovery Timeline
- 2026-08-25 - CVE-2026-79291 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79291
Vulnerability Analysis
The vulnerability resides in Chrome's CSS processing pipeline. Google's advisory describes the issue as an information leak triggered by processing attacker-supplied HTML and style content. Because the flaw is exposed to network attackers over standard web traffic, any user who loads a malicious page in an unpatched browser is at risk. The impact is limited to confidentiality; the vulnerability does not permit code execution or modification of browser state on its own.
Information exposed through CSS-based leaks in browsers typically includes cross-origin content details, rendering state, timing signals, or data that violates the Same-Origin Policy. This class of flaw is commonly used to fingerprint users, exfiltrate cross-origin resource properties, or stage more complex chained attacks against authenticated sessions.
Root Cause
Google has not released full technical details, and the referenced Chromium Issue Tracker #518023156 remains access-restricted per Chromium disclosure policy. The root cause is documented as improper handling within the CSS subsystem that permits sensitive information to cross a trust boundary during style resolution or layout.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page containing malicious CSS constructs and lures a victim to visit it, or injects such content into a site the victim already trusts through cross-site scripting or a compromised third-party resource. When the browser parses the page, the vulnerable CSS code path discloses information that the attacker then reads or exfiltrates through observable side effects such as resource loads or reported style values. See the Chrome Releases stable channel update for the vendor advisory.
Detection Methods for CVE-2026-79291
Indicators of Compromise
- Browser telemetry showing Chrome desktop versions earlier than 152.0.7977.65 in active use across the fleet
- Web proxy or DNS logs recording connections to newly registered or low-reputation domains delivering HTML with unusually complex CSS payloads
- Outbound requests to attacker-controlled endpoints correlated with style-based resource loads such as background images or @font-face fetches with encoded parameters
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65 as vulnerable
- Monitor HTTP responses for pages that combine cross-origin iframe embeds with dynamic CSS selectors targeting sensitive attributes
- Correlate browser process activity with outbound web requests to identify style-driven data exfiltration patterns
Monitoring Recommendations
- Ingest browser version telemetry into your SIEM or data lake and alert on outdated Chrome installations
- Track user navigations to unclassified or newly observed domains where Chrome is the referring process
- Review web proxy logs for anomalous volumes of image, font, or stylesheet requests from single page loads
How to Mitigate CVE-2026-79291
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed desktops
- Trigger a browser restart policy after deployment to ensure the patched binary is loaded into user sessions
- Audit Chromium-based third-party applications, such as Electron builds, and update them to versions incorporating the fixed Chromium release
Patch Information
Google addressed CVE-2026-79291 in the Chrome Stable Channel release announced in the Chrome Releases stable channel update. Deploy the update through enterprise channels such as Google Chrome Enterprise policies, Microsoft Intune, Jamf, or your standard software management platform. Confirm the running version at chrome://settings/help after deployment.
Workarounds
- Restrict access to untrusted websites through web filtering or DNS-layer controls until the patch is deployed
- Enforce enterprise browser policies that limit third-party cookies and cross-site tracking to reduce information leakage surface
- Advise users to avoid opening unsolicited links and to report suspicious pages to the security team
# Verify the deployed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Verify the deployed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString
# Verify the deployed Chrome version on Linux endpoints
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
