CVE-2026-78897 in Chrome
Summary
by MITRE • 08/26/2026
Missing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as missing authorization within the BrowserTag component of Google Chrome represents a critical failure in access control mechanisms, specifically allowing unauthorized entities to interact with browser state data. This flaw exists in versions prior to 152.0.7977.65 and stems from an insufficient validation process when handling requests initiated by extensions or web content interacting with the BrowserTag API. The core technical issue lies in the absence of strict permission checks that verify whether the calling context possesses the necessary privileges to access specific browser tags or associated metadata. In a properly secured environment, any request accessing sensitive browser state must be authenticated and authorized against the user's granted permissions for that particular extension or origin. However, due to this oversight, an attacker can bypass these controls by crafting a malicious Chrome extension that exploits the permissive nature of the BrowserTag interface.
The operational impact of this vulnerability is primarily centered on information disclosure through social engineering tactics. Since the flaw allows remote attackers to obtain sensitive information without explicit user consent or proper authorization checks, it poses a significant risk to user privacy and data integrity. An attacker would typically distribute a seemingly legitimate but malicious Chrome extension via phishing campaigns, compromised websites, or third-party repositories. Once installed by an unsuspecting victim who grants standard permissions such as access to browsing history or tabs, the extension can silently query BrowserTag endpoints to extract sensitive metadata about open tabs, visited URLs, or other browser state information that should remain private. This capability enables detailed profiling of user behavior and interests without triggering typical security warnings associated with high-privilege actions like reading passwords or injecting scripts into pages.
From a threat modeling perspective, this vulnerability aligns closely with CWE-269, which describes Improper Privilege Assignment, as the system fails to enforce appropriate access levels for different actors within the browser environment. Furthermore, it maps to MITRE ATT&CK technique T1530, Data from Local System Exfiltration, specifically under sub-techniques related to data staging or collection via installed software components like extensions. The attack vector is classified as remote with a low complexity requirement because it relies on social engineering rather than complex exploitation chains, making it accessible to a broad range of threat actors including opportunistic cybercriminals and advanced persistent threats seeking initial footholds through user trust manipulation.
Mitigation strategies for this vulnerability involve both immediate patching and long-term architectural improvements. The primary remediation is upgrading Google Chrome to version 152.0.7977.65 or later, where the authorization checks within BrowserTag have been corrected to enforce strict permission validation before allowing data retrieval. For organizations managing enterprise deployments, enforcing automatic updates through group policy or endpoint management solutions ensures that users are protected against this specific flaw without requiring manual intervention. Additionally, security awareness training should be implemented to educate users about the risks of installing extensions from unverified sources and the importance of reviewing extension permissions carefully during installation. Developers building Chrome extensions must also adhere to the principle of least privilege by requesting only the minimum set of permissions necessary for their functionality and implementing robust client-side validation logic where applicable, although server-side or browser-enforced checks remain the primary defense against such authorization bypasses.