CVE-2026-79059 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an information leak within the Back-Forward Cache, commonly referred to as BFCache, in Google Chrome prior to version 152.0.7977.65 represents a significant breach of browser isolation principles. The Back-Forward Cache is designed to store complete page states, including DOM content and JavaScript execution contexts, to enable instant navigation when users click the back or forward buttons. This feature improves performance by avoiding redundant network requests and script re-execution. However, in this specific instance, the implementation failed to properly sanitize or isolate cached data across different origin boundaries under certain conditions involving renderer process compromise. The flaw allows a remote attacker who has already achieved code execution within a compromised renderer process to access sensitive cross-origin data that should remain inaccessible due to the Same-Origin Policy. This scenario typically arises when an attacker exploits a separate vulnerability, such as a sandbox escape or arbitrary read/write primitive in another tab or frame, and then leverages the BFCache mechanism to exfiltrate state from other browsing contexts.
From a technical perspective, this flaw falls under CWE-200: Information Exposure, specifically relating to exposure of sensitive information through cached data that is not properly cleared or isolated upon navigation events. The attacker crafts an HTML page designed to trigger specific rendering and caching behaviors that expose the internal state of cross-origin pages stored in BFCache. Because the renderer process handles web content execution, compromising it provides a foothold within the browser's multi-process architecture. Once inside this sandboxed environment, the attacker can manipulate DOM elements or JavaScript objects associated with cached pages from other origins. The vulnerability exploits the fact that BFCache retains sensitive session data, cookies, and dynamic content without sufficient checks to ensure that access is restricted solely to the original origin context during restoration events. This undermines the fundamental security model of web browsers which relies on strict separation between different website contexts.
The operational impact of this vulnerability is severe for users who engage in multi-tab browsing or maintain sessions across multiple domains simultaneously. An attacker capable of compromising a renderer process, potentially through a drive-by download, malicious advertisement, or phishing site with an associated exploit chain, can silently extract confidential information from other open tabs. This includes personal identifiable information, financial data, authentication tokens, and private communications stored within web applications. The medium severity rating assigned by Chromium reflects the complexity of exploitation which requires prior renderer compromise but acknowledges the high value of the resulting data leakage. Victims may suffer identity theft, account takeover, or corporate espionage depending on the nature of the accessed cross-origin resources. Since BFCache operates transparently to the user, detection is difficult without specialized monitoring tools that track memory access patterns and cache invalidation events across origin boundaries.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.65 or later where these isolation checks have been strengthened. Users should enable automatic updates to ensure timely patching of such vulnerabilities as they are discovered by the Chromium security team. For enterprise environments, implementing strict Content Security Policies can help limit the impact if renderer compromise occurs by restricting script execution and data exfiltration vectors. Additionally, disabling BFCache for sensitive applications via server-side headers like Cache-Control: no-store or using session storage instead of local storage for critical data reduces the attack surface. Monitoring browser logs for unusual memory access patterns may aid in detecting active exploitation attempts. Security awareness training should emphasize that even with a secure browser version, maintaining good hygiene regarding untrusted content remains essential to prevent initial renderer compromise which is often the prerequisite for exploiting this type of flaw.
This incident aligns with ATT&CK technique T1005: Data from Local System, where adversaries seek to collect data directly from local sources without network communication initially, and potentially T1213: Data from Information Repositories if the cached content serves as a repository of sensitive state. The vulnerability highlights the ongoing challenge in browser security regarding maintaining strict boundaries between processes and origins while optimizing performance through features like BFCache. Continuous refinement of these isolation mechanisms is critical to prevent attackers from leveraging caching behaviors for cross-origin data theft.