CVE-2026-8022: Google Chrome MHTML Information Disclosure

CVE-2026-8022 Overview

CVE-2026-8022 is a cross-origin information disclosure vulnerability in the MIME HTML (MHTML) implementation of Google Chrome before version 148.0.7778.96. A remote attacker can host a crafted MHTML page that, when combined with specific user interface gestures, leaks data from a different origin to the attacker. The flaw is categorized under CWE-1021: Improper Restriction of Rendered UI Layers or Frames and was rated Low severity by the Chromium security team.

Exploitation requires user interaction and a low-probability sequence of UI events, which limits practical impact.

Critical Impact

A successful attack discloses limited cross-origin data through a crafted MHTML page, breaking the same-origin policy boundary the browser is expected to enforce.

Affected Products

• Google Chrome desktop versions prior to 148.0.7778.96
• Chromium-based browsers that incorporate the affected MHTML rendering code
• Embedded WebView and Electron-style runtimes built on pre-148 Chromium

Discovery Timeline

• 2026-05-06 - CVE-2026-8022 published to the National Vulnerability Database
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-8022

Vulnerability Analysis

The vulnerability resides in how Chrome parses and renders MHTML archives. MHTML packages an HTML document together with its referenced resources, such as images, stylesheets, and scripts, into a single multipart MIME container. Chrome must enforce origin boundaries between the MHTML document and other browsing contexts when the archive is rendered.

The inappropriate implementation allows a crafted MHTML page to interact with content from a different origin once the user performs specific UI gestures. The result is a leak of cross-origin data that should remain isolated under the same-origin policy.

Because exploitation depends on convincing the user to load attacker-controlled MHTML content and to perform a particular interaction sequence, the attack complexity is high and confidentiality impact is limited.

Root Cause

The root cause is improper enforcement of UI and frame layering rules in the MHTML code path, consistent with CWE-1021. Chrome treats certain rendering states inside an MHTML archive in a way that does not preserve the cross-origin restrictions normally applied to live web content. The Chromium issue tracker entry for this bug is referenced in the Chromium Issue Tracker Update.

Attack Vector

An attacker delivers an .mhtml file or serves an MHTML response from a controlled site. The user opens the archive in Chrome, then performs a UI gesture such as clicking, dragging, or focusing a specific element. The crafted layout uses this interaction to extract content from a cross-origin context loaded inside the MHTML document. No specific exploit code or proof-of-concept is publicly available for CVE-2026-8022. See the Google Chrome Release Notes for vendor-supplied details.

Detection Methods for CVE-2026-8022

Indicators of Compromise

• Inbound email or web downloads delivering files with the .mhtml or .mht extension from untrusted senders or domains
• HTTP responses with Content-Type: multipart/related or message/rfc822 originating from low-reputation hosts
• Browser process telemetry showing Chrome instances older than 148.0.7778.96 rendering MHTML archives followed by outbound connections to unfamiliar domains

Detection Strategies

• Inventory installed Chrome and Chromium-derived browser versions across managed endpoints and flag any build below 148.0.7778.96
• Inspect web and email gateway logs for MHTML attachments and downloads, correlating user interaction with subsequent network activity
• Hunt for Chrome child process activity that opens local MHTML files from temporary or download directories shortly after an email or chat client launches

Monitoring Recommendations

• Forward browser version data and download events into a central data lake or SIEM to enable continuous version-drift detection
• Alert on user-opened MHTML archives delivered from external sources, especially when followed by cross-domain HTTP requests
• Track repeated delivery of MHTML content to multiple users from the same sender or domain as a possible targeted campaign indicator

How to Mitigate CVE-2026-8022

Immediate Actions Required

• Update Google Chrome to version 148.0.7778.96 or later on all supported platforms
• Restart browser sessions after the update so the patched binary is loaded into memory
• Audit Chromium-based applications and embedded WebView components for the underlying Chromium version and update them once vendors ship fixes

Patch Information

Google addressed CVE-2026-8022 in the Chrome Stable channel update referenced in the Google Chrome Release Notes. The fix is included in 148.0.7778.96 and later builds. Enterprises using managed Chrome deployments should confirm that automatic updates are enabled and that the RelaunchNotification policy enforces a timely browser restart.

Workarounds

• Block delivery of .mhtml and .mht attachments at email and web gateways until endpoints are patched
• Configure Chrome enterprise policies to prevent opening MHTML files from untrusted file paths or external download sources
• Educate users to avoid opening MHTML archives from unsolicited messages and to report suspicious files to the security team

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version