CVE-2026-79070 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect reference resolution in Cache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect reference resolution within the browser cache component of Google Chrome versions prior to 152.0.7977.65 represents a significant deviation from expected web isolation principles. This flaw stems from how the rendering engine and caching subsystem interact when resolving resource references during page load sequences. Specifically, the mechanism responsible for determining whether a cached object belongs to a specific origin failed to correctly validate the source context under certain edge cases involving crafted HTML structures. When an attacker constructs a malicious webpage that triggers this specific resolution path, the browser incorrectly associates resources or state data with a different security origin than intended by the standard Same-Origin Policy enforcement mechanisms.
From a technical perspective, this issue falls squarely within the domain of CWE-20 Improper Input Validation and more specifically aligns with CWE-918 Server-Side Request Forgery (SSRF) variants where internal or cross-origin resource access is improperly granted due to flawed logic in reference handling. The core defect lies in the cache lookup algorithm, which likely failed to properly sanitize or verify the origin header context before serving a cached response that was originally fetched from a different domain. This allows an attacker-controlled page hosted on one origin to indirectly retrieve sensitive data or execute scripts associated with another trusted origin by leveraging the browser's caching layer as a conduit for unauthorized access.
The operational impact of this vulnerability is primarily centered around the bypassing of web origin policies, which are fundamental to modern web security architecture. By exploiting this flaw, a remote attacker can potentially read cross-origin responses that should have been blocked, leading to data exfiltration scenarios where sensitive information such as session tokens, personal user details, or proprietary application state could be leaked to an unauthorized third party. Furthermore, depending on the specific resources cached and accessible through this bypass, there is a risk of Cross-Site Scripting (XSS) if the attacker can inject malicious scripts into the context of a trusted site via the misresolved cache entry. This undermines user trust in browser isolation boundaries and compromises confidentiality and integrity guarantees provided by standard web security models.
In terms of threat modeling, this vulnerability maps to MITRE ATT&CK techniques related to Collection from Browser or Data Staged for Exfiltration, as it facilitates unauthorized data access through legitimate browser functionality abused via crafted input. It also relates to Defense Evasion tactics where the attacker uses trusted system components like the cache manager to bypass security controls without triggering typical intrusion detection signatures associated with direct network attacks. The medium severity rating assigned by Chromium reflects that while exploitation requires specific crafting of HTML and potentially user interaction or precise timing, the potential for data leakage makes it a serious concern requiring prompt remediation.
Mitigation strategies focus primarily on applying the official software updates provided by Google to ensure all instances are running version 152.0.7977.65 or later where this reference resolution logic has been corrected. For environments unable to update immediately, network-level controls such as strict Content Security Policy headers can help mitigate some impacts by restricting which origins are allowed to load resources and preventing inline script execution that might be leveraged in conjunction with the cache bypass. Additionally, disabling third-party cookies or implementing robust anti-CSRF tokens for sensitive operations adds layers of defense against exploitation attempts derived from this origin policy violation. Regular security audits focusing on caching logic and cross-origin resource sharing configurations are recommended to identify similar architectural weaknesses before they can be weaponized by remote attackers.