CVE-2026-79023 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization flaw within the editing subsystem of Google Chrome, specifically in versions prior to 152.0.7977.65, represents a significant breach in access control mechanisms that governs how user interactions with web content are processed and validated. This issue stems from a failure by the browser engine to properly verify whether the context initiating an edit operation possesses the necessary privileges or permissions relative to the target element being modified. In modern web browsers, editing capabilities such as those provided by the document.execCommand API or ContentEditable attributes allow users to modify HTML content directly within the viewport. However, these operations often interact with internal browser states and security boundaries that must be strictly enforced to prevent cross-context data leakage. When this authorization check is bypassed or incorrectly implemented, it creates a pathway for malicious actors to exploit the trust relationship between the user's browsing session and the rendered page content.
From a technical perspective, the flaw allows a remote attacker to craft an HTML page containing specific scripts that trigger editing operations on elements they do not have explicit permission to access. By leveraging this misconfiguration, the attacker can induce the browser to expose sensitive information contained within protected or restricted areas of the DOM structure. This could include data from other tabs if same-origin policies are circumvented through complex race conditions or state manipulation, or it may involve extracting content that was intended to be hidden via CSS but is inadvertently exposed due to improper validation during the editing process. The severity being rated as medium by Chromium indicates that while exploitation requires user interaction such as visiting a malicious site and potentially triggering specific UI events, the potential for data exfiltration remains substantial enough to warrant immediate attention.
The operational impact of this vulnerability centers on confidentiality loss rather than integrity or availability in most scenarios. An attacker successfully exploiting this flaw could obtain sensitive information from the victim's browsing session without their knowledge. This might include personal identifiable information, financial details, or proprietary content displayed within web applications that rely heavily on client-side editing features for functionality. The attack vector is classified as remote because it requires no prior access to the target system and can be executed simply by directing a user to a maliciously constructed webpage. This aligns with common threat models where social engineering combined with technical exploitation leads to unauthorized data acquisition, undermining the security posture of both individual users and organizations relying on Chrome for secure web interactions.
In terms of industry standards classification, this vulnerability maps closely to CWE-269 Improper Privilege Management or CWE-862 Missing Authorization, as it involves a failure to enforce proper access controls during an editing operation. It also relates to CWE-79 Cross-site Scripting if the exploitation leads to script injection that facilitates data theft, although the primary vector here is information disclosure through improper authorization checks. From a defensive perspective, this aligns with MITRE ATT&CK techniques such as T1056 Input Capture or T1005 Data from Local System, depending on how the sensitive information is extracted and exfiltrated. The browser's role in mediating between user input and DOM manipulation makes it a critical target for these types of logic flaws where state management and permission verification are complex.
Mitigation strategies primarily involve updating to Google Chrome version 152.0.7977.65 or later, which contains the necessary patches to enforce stricter authorization checks during editing operations. For organizations unable to update immediately due to compatibility constraints, implementing strict Content Security Policy headers can help mitigate some risks by restricting how scripts interact with page content and preventing unauthorized data exfiltration attempts. Additionally, disabling unnecessary JavaScript execution on untrusted sites through browser extensions or group policies can reduce the attack surface available to remote attackers. Regular security audits of web applications that utilize rich text editing features are also recommended to ensure they do not inadvertently expose sensitive data through improper handling of user inputs.