CVE-2026-79018 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in FoldableAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified within the Foldable APIs of Google Chrome, specifically affecting versions prior to 152.0.7977.65, represents a classic instance of an improper restriction of operations by information leak. This flaw allows a remote attacker to extract sensitive data that should remain confined to the browser's secure execution environment. The attack vector relies on social engineering or malicious web content where a crafted HTML page is served to the victim. When this page interacts with the Foldable APIs, it exploits insufficient validation or boundary checks within the API implementation, enabling the extraction of internal state information or device-specific data that was not intended for public access via standard web interfaces.
From a technical perspective, the Foldable APIs are designed to provide web applications with insights into the physical form factor and hinge status of foldable devices. However, in this specific vulnerability context, the implementation failed to properly sanitize or restrict the scope of information returned during these interactions. This lack of strict access control permits an attacker who controls a malicious webpage to query internal browser states or device properties that could reveal user location data, hardware identifiers, or other contextual metadata. The severity is classified as Low by Chromium security standards because while sensitive information is exposed, it typically requires the victim to interact with a specific crafted page and does not allow for arbitrary code execution or direct system compromise on its own.
The operational impact of this vulnerability centers around privacy erosion and potential reconnaissance for further attacks. By obtaining sensitive information such as device characteristics or user context through the Foldable APIs, an attacker can build detailed profiles of users without their consent. This data could be used to tailor subsequent phishing attempts, bypass certain security controls that rely on device fingerprinting, or simply violate user privacy expectations. Although the direct impact is limited to information disclosure, the accumulation of such metadata significantly reduces the anonymity and security posture of the end-user in a web browsing context.
To mitigate this risk, users must ensure they are running Google Chrome version 152.0.7977.65 or later, where these boundary checks have been reinforced to prevent unauthorized data retrieval through the Foldable APIs. For organizations managing enterprise deployments, it is critical to enforce automatic update policies to minimize exposure windows. Additionally, security teams should monitor for unusual network traffic patterns originating from browser processes that might indicate exploitation attempts against this specific API endpoint. Implementing strict Content Security Policies and restricting access to sensitive web platform features can further reduce the attack surface associated with such vulnerabilities.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-200, which covers Exposure of Sensitive Information to an Unauthorized Actor. It also relates to ATT&CK technique T1537, specifically under the sub-category of Communication Through Web Protocols if the exfiltration occurs via standard HTTP requests triggered by the malicious page. Understanding these mappings helps in categorizing the incident correctly within broader security frameworks and ensures that remediation efforts address both the immediate technical flaw and the underlying architectural weaknesses in API access controls.