CVE-2026-79034 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in CORS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability described constitutes a significant breach of browser isolation mechanisms, specifically targeting the Cross-Origin Resource Sharing policy within Google Chrome prior to version 152.0.7977.65. This flaw allows for the unauthorized exfiltration of sensitive cross-origin data by an attacker who has already achieved code execution or compromise within the renderer process. The core issue lies in how the browser handles CORS headers and preflight requests, where improper validation logic enables a maliciously crafted HTML page to bypass standard security boundaries. When a user interacts with such a page while logged into other services, the browser may inadvertently send credentials or sensitive data across origin boundaries without proper authorization checks, effectively neutralizing one of the primary defenses against cross-site attacks in modern web applications.
From a technical perspective, this flaw represents an information disclosure vulnerability where the application fails to properly restrict access to resources based on their source origin. The attacker leverages the compromised renderer process to craft specific HTTP requests that exploit inconsistencies in how Chrome interprets CORS policies. By manipulating headers or request methods, the malicious script can trick the browser into believing that a cross-origin request is legitimate and authorized. This results in the leakage of data such as session tokens, personal identifiable information, or other confidential content stored by third-party websites accessed during the same browsing session. The severity is classified as medium because while it requires an initial compromise of the renderer process, the impact involves direct access to sensitive user data from unrelated domains, which can lead to account takeover or further lateral movement within a victim's digital environment.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-200, which defines information exposure through misconfigured security controls. It also maps closely to MITRE ATT&CK technique T1530, Data from Local System, specifically the sub-technique of data exfiltration via browser-based methods. The attack vector relies on social engineering or drive-by download tactics to get a victim to load the crafted HTML page, after which the automated script executes in the context of the compromised renderer. This allows the attacker to silently scrape and transmit sensitive information without user interaction beyond the initial page load, making detection difficult for both users and traditional security monitoring tools that do not inspect browser-level network traffic closely.
The operational impact of this vulnerability is severe for organizations relying on Chrome as their primary web client. It undermines the trust model of single sign-on systems and multi-tab browsing environments where users expect strict isolation between different websites. An attacker can use this flaw to harvest authentication cookies, CSRF tokens, or private API responses from high-value targets such as banking portals, email services, or enterprise internal applications. This data can then be used for identity theft, financial fraud, or further infiltration of corporate networks if the stolen credentials provide access to additional systems. The risk is amplified in shared computing environments where multiple users might share a device, allowing an attacker with local renderer compromise to target any active session regardless of which user initiated it.
Mitigation strategies primarily involve immediate software updates to ensure all client machines are running Google Chrome version 152.0.7977.65 or later, as this release contains the necessary patches for the CORS handling logic. In environments where patching is delayed due to compatibility concerns, administrators should enforce strict Content Security Policy (CSP) headers on internal web applications to limit which origins can make cross-origin requests. Additionally, enabling SameSite cookie attributes helps prevent browsers from sending cookies in cross-site contexts by default, reducing the impact of such leaks even if a renderer process is compromised. Users are advised to maintain up-to-date browser versions and avoid clicking on untrusted links or loading unknown HTML files, particularly when sensitive sessions are active. Regular security audits focusing on CORS configurations across all web-facing assets remain essential to minimize the attack surface for this class of vulnerabilities.