CVE-2026-79098 in Chrome
Summary
by MITRE • 08/26/2026
UI misrepresentation in PermissionElement in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as a user interface misrepresentation within the PermissionElement component of Google Chrome prior to version 152.0.7977.65 represents a significant trust boundary violation that exploits the browser's permission request mechanism. This flaw allows for the spoofing of critical UI elements, specifically those related to permissions such as camera, microphone, location, or notifications. By leveraging social engineering techniques, an attacker can craft a malicious HTML page designed to manipulate how these requests are presented to the end user. The core technical issue lies in the rendering logic of the PermissionElement, where the visual representation of the permission dialog does not accurately reflect the actual origin requesting access or the specific nature of the data being sought. This discrepancy creates an opportunity for deceptive practices that bypass user awareness and consent mechanisms intended to protect privacy and security.
From a technical perspective, this vulnerability falls under the category of UI Redressing attacks, which are formally classified in the Common Weakness Enumeration (CWE) database as CWE-836: Use of Password Hash Instead of Password for Authentication when considering trust decisions, or more accurately CWE-1021: Improper Restriction of Rendered UI Layers or Frames. In this specific context, it aligns closely with CWE-798: Use of Hard-coded Credentials if the spoofing involves mimicking legitimate system prompts, but primarily it is a form of Clickjacking or Phishing via UI manipulation where the attacker controls the visual layer to deceive the user into granting permissions they would otherwise deny. The Chromium security team has categorized this with a Low severity rating because while the potential for harm exists, successful exploitation requires active social engineering and does not involve direct code execution or memory corruption vulnerabilities that could lead to remote code execution on the victim's machine.
The operational impact of this vulnerability is primarily centered around privacy violations and increased susceptibility to further attacks. When users are presented with a spoofed permission dialog, they may inadvertently grant access to sensitive hardware resources such as webcams or microphones without realizing the true source of the request. This can lead to unauthorized surveillance or data collection by malicious actors. Furthermore, granting these permissions under false pretenses can facilitate subsequent phases of an attack chain, such as credential harvesting if the spoofed UI mimics a login prompt for a trusted service, or malware distribution if the permission allows access to file systems in certain contexts. The reliance on social engineering means that the effectiveness of this exploit is highly dependent on user behavior and awareness, making it a persistent threat vector even after technical patches are applied.
Mitigation strategies must address both immediate remediation and long-term defensive posture. The primary mitigation is the prompt application of browser updates to version 152.0.7977.65 or later, which contains the necessary code fixes to ensure that UI elements accurately represent their underlying functionality and origin. Beyond patching, organizations should enforce strict content security policies (CSP) to restrict how permissions are requested and displayed within enterprise environments. User education remains critical; administrators should train employees to verify the URL bar and certificate details before interacting with any permission prompts, regardless of how legitimate they appear. Additionally, deploying browser extensions or endpoint detection solutions that monitor for anomalous UI behavior or unauthorized permission grants can provide an additional layer of defense against such social engineering attacks. Regular security awareness training focusing on recognizing phishing attempts and UI spoofing techniques is essential to reduce the success rate of these exploits in real-world scenarios.