CVE-2026-78947 in Chrome
Summary
by MITRE • 08/25/2026
Incomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified as an incomplete cleanup issue within the Chromium engine, specifically affecting versions of Google Chrome prior to 152.0.7977.65, represents a subtle but significant deviation from expected state management protocols during extension lifecycle operations. This flaw is categorized under CWE-483, which denotes Inconsistent Cleanup in Switch or Loop contexts, although it manifests here through the failure to properly revoke permissions or clear security boundaries when an extension is uninstalled or disabled by the user. The core technical deficiency lies in the browser's internal handling of origin isolation policies associated with installed extensions. When a malicious actor crafts a Chrome extension designed to exploit this state inconsistency, they can manipulate the browser into retaining elevated privileges or access scopes that should have been revoked upon removal or modification of the extension profile. This creates a persistent foothold where the security context intended for legitimate application functionality remains active in memory or configuration stores even after the user believes they have removed the threat vector.
The operational impact of this vulnerability is primarily centered on the bypassing of web origin policies, which are fundamental to browser security models designed to prevent cross-site scripting and unauthorized data access between different domains. By leveraging social engineering techniques, an attacker can persuade a victim to install or interact with a seemingly benign extension that contains code exploiting this incomplete cleanup mechanism. Once installed, the extension may perform actions under its original permissions even after it has been ostensibly removed or disabled, effectively maintaining a channel for cross-origin data exfiltration or unauthorized access to sensitive web resources. This undermines the principle of least privilege and allows an attacker to maintain persistence within the user's browsing environment without triggering standard security alerts associated with new installations. The severity is rated as low by Chromium standards because it requires active user interaction and social engineering, rather than being a purely remote code execution vector accessible via passive webpage visits alone.
From a threat intelligence perspective, this vulnerability aligns closely with MITRE ATT&CK technique T1059.007, which covers Command and Scripting Interpreter through browser extensions, as well as aspects of T1534, Internal Spearphishing, given the reliance on social engineering to gain initial access. The exploitation path typically involves an attacker distributing a malicious extension that appears legitimate or useful, thereby bypassing user skepticism. Upon installation, the extension establishes its presence and permissions. When the victim attempts to remove it, the incomplete cleanup logic fails to fully dismantle the security context associated with the extension's origin. This allows subsequent scripts loaded by other sites within the same origin scope to potentially access data that should have been isolated or revoked. The persistence of these privileges can lead to session hijacking, credential theft, or unauthorized tracking across websites that share the compromised origin boundary.
Mitigation strategies for this vulnerability require both immediate patching and long-term security hygiene practices. Users must update Google Chrome to version 152.0.7977.65 or later as soon as possible, as this release contains the necessary code corrections to ensure proper cleanup of extension states upon uninstallation or disablement. Administrators managing enterprise environments should enforce automatic updates through group policies to prevent exposure during the window between vulnerability disclosure and patch deployment. Additionally, users are advised to exercise extreme caution when installing browser extensions from third-party sources, verifying the publisher's reputation and reviewing requested permissions before installation. Regular auditing of installed extensions can help identify any suspicious activity or lingering processes that may indicate exploitation attempts. Security teams should also monitor for unusual network traffic originating from local extension hosts, as this could signal active exploitation of residual privileges left behind by improperly cleaned-up components.