CVE-2026-79133 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization flaw within the forms handling subsystem of Google Chrome, specifically in versions prior to 152.0.7977.65, represents a significant breach in access control mechanisms designed to protect user data integrity and confidentiality. This issue stems from a failure in the browser's internal logic to properly validate permissions or state transitions when processing form submissions or interactions with web-based forms. In modern web applications, browsers enforce strict same-origin policies and authorization checks to ensure that sensitive operations are only executed by authorized contexts. However, in this specific instance, the enforcement of these controls was insufficient, allowing a remote attacker to bypass expected security boundaries through the delivery of a specially crafted HTML page.
From a technical perspective, the flaw likely involves an improper check on the origin or permissions associated with form data before it is processed or transmitted. When a user interacts with a web page containing maliciously constructed forms, the browser may fail to verify whether the context requesting access to certain sensitive information has legitimate authorization. This could manifest as the leakage of autofill data, such as usernames, passwords, credit card numbers, or personal identification details, which are typically stored locally and protected by strict access controls. The attacker crafts an HTML page that exploits this gap in logic, potentially tricking the browser into exposing these sensitive fields to unauthorized scripts or external domains without proper user consent or validation.
The operational impact of this vulnerability is primarily centered on information disclosure and potential credential theft. By leveraging a crafted HTML page, which can be hosted on any website or delivered via phishing campaigns, an attacker can extract sensitive user data that was previously considered secure within the browser's sandboxed environment. This compromises the confidentiality aspect of the CIA triad for users browsing with affected versions of Chrome. The severity is classified as low by Chromium security standards, suggesting that while the vulnerability exists and poses a risk, it may require specific conditions or user interaction to be fully exploited, such as convincing the victim to visit a malicious site where their sensitive data might already be partially exposed or accessible due to other factors like session hijacking.
To mitigate this risk, users are strongly advised to update Google Chrome immediately to version 152.0.7977.65 or later, where these authorization checks have been corrected and hardened against such exploitation attempts. From a defensive posture perspective, organizations should ensure that endpoint protection solutions are configured to detect unusual data exfiltration patterns from browsers, although the primary defense remains timely patching of browser software. Additionally, users can employ additional layers of security such as multi-factor authentication for critical accounts to reduce the value of stolen credentials and utilize password managers with strict domain-binding features to limit exposure even if a vulnerability is exploited.
This incident aligns with CWE-269, which describes Improper Authorization, where an actor is able to access or perform actions on resources that they should not have permission to do so. It also relates to the ATT&CK technique of T1059, Command and Scripting Interpreter, as the attack vector involves executing malicious code via a crafted HTML page within the browser environment. The remediation strategy focuses on correcting the underlying authorization logic in the forms processing module, ensuring that all access requests are rigorously validated against established security policies before any sensitive data is exposed or transmitted.