CVE-2026-79293: Chrome Animation Information Disclosure

CVE-2026-79293 Overview

CVE-2026-79293 is an information disclosure vulnerability in the Animation component of Google Chrome prior to version 152.0.7977.65. A remote attacker can leak sensitive information by convincing a user to load a crafted HTML page. The Chromium security team rated the flaw Medium severity, and it is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

The issue affects any Chromium-based browser build that inherits the vulnerable Animation code before the fixed release. Exploitation requires user interaction, typically visiting an attacker-controlled page, but no authentication or elevated privileges.

Critical Impact
A remote attacker can read sensitive in-process data from the renderer via a crafted HTML page, enabling reconnaissance for follow-on attacks against the browser sandbox.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers that consume the vulnerable Animation code
Embedded WebView components built on pre-152 Chromium

Discovery Timeline

2026-08-25 - CVE-2026-79293 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in the NVD database

Technical Details for CVE-2026-79293

Vulnerability Analysis

The flaw resides in the Animation subsystem of Blink, the rendering engine used by Google Chrome. Improper handling of internal state during animation processing exposes data that should remain isolated from the JavaScript context. An attacker who serves a crafted HTML page can trigger the leak and read values inside the renderer process.

The vulnerability requires user interaction, reflected in the CVSS user interaction requirement. The scope is limited to confidentiality, with no direct integrity or availability impact. Attackers commonly chain information leaks with memory corruption bugs to defeat address space layout randomization (ASLR) inside the renderer sandbox.

Public Chromium tracker Issue #517746687 references the fix, and the Google Chrome Stable Update announcement lists the shipped patch.

Root Cause

The root cause is classified as [CWE-200], where the Animation code path returns or exposes data that crosses a trust boundary. Specific implementation details are restricted while Chrome users update, following Chromium disclosure policy. The upstream commit is referenced in the linked Chromium issue.

Attack Vector

An attacker hosts a malicious HTML page containing crafted animation content. When a victim visits the page, the browser processes the animation and leaks in-process data readable to attacker-controlled JavaScript. Exploitation does not require plugins, extensions, or authentication.

No verified public proof-of-concept code is available. See the Chromium Issue #517746687 for restricted technical details.

Detection Methods for CVE-2026-79293

Indicators of Compromise

Chrome renderer processes loading HTML from newly registered or low-reputation domains that host animation-heavy content
Browser telemetry showing outbound POSTs of encoded blobs immediately after animation rendering
Endpoints running Chrome versions below 152.0.7977.65 after the patch release date

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds older than 152.0.7977.65
Correlate web proxy logs with browser process telemetry to identify visits to attacker-controlled pages that trigger unusual renderer memory activity
Use browser management policies to report Chrome version compliance to a central console

Monitoring Recommendations

Alert on Chrome installations that fall behind the current Stable channel by more than one release
Monitor DNS and TLS SNI telemetry for domains delivering crafted HTML flagged by threat intelligence feeds
Track anomalous data volume egress from chrome.exe renderer processes shortly after page loads

How to Mitigate CVE-2026-79293

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Restart Chrome after the update so the patched binaries are loaded into memory
Verify Chromium-based browsers such as Edge, Brave, and Opera have consumed the upstream fix

Patch Information

Google addressed the vulnerability in Chrome Stable 152.0.7977.65. Refer to the Google Chrome Stable Update announcement for release notes and the Chromium Issue #517746687 tracker for the upstream fix reference.

Workarounds

Enforce Chrome auto-update policies through group policy or MDM to prevent version drift
Restrict browsing to trusted sites via web filtering until patch deployment completes
Disable JavaScript for high-risk user groups where feasible until updates are confirmed

bash

# Configuration example: enforce Chrome auto-update via Group Policy on Windows
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f

# Verify installed Chrome version
"C:\Program Files\Google\Chrome\Application\chrome.exe" --version