CVE-2026-79179 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization issue within the Document Object Model of Google Chrome, specifically affecting versions prior to 152.0.7977.65, represents a significant breach in browser-side access control mechanisms. This flaw stems from improper validation checks when handling cross-origin requests or DOM manipulation operations, allowing scripts executed on one origin to inadvertently gain elevated privileges over resources belonging to another origin. In modern web architectures, the same-origin policy is the cornerstone of security, ensuring that documents or scripts loaded from one source cannot interact with resources from a different source without explicit permission. When this enforcement fails within the browser's rendering engine, it creates an avenue for unauthorized data access, undermining the fundamental isolation principles designed to protect user privacy and application integrity.
From a technical perspective, the defect likely involves a race condition or a logic error in how Chrome processes DOM APIs that interact with cross-origin frames or iframes. An attacker can craft a malicious HTML page containing JavaScript code that exploits this misconfiguration to read sensitive data from other web applications hosted on different domains. This could include session tokens, personal identifiable information, financial details, or internal application states that are rendered in the browser but not properly isolated due to the authorization flaw. The severity is classified as low by Chromium security standards because while the potential for data leakage exists, successful exploitation typically requires specific contextual conditions such as user interaction with a crafted page and the presence of sensitive data accessible via DOM APIs without adequate cross-origin checks.
The operational impact of this vulnerability centers on information disclosure rather than remote code execution or system compromise. A remote attacker leveraging this flaw could potentially exfiltrate confidential user data by embedding malicious scripts in phishing pages, compromised websites, or advertisements served through ad networks. This aligns with the ATT&CK technique T1059, specifically JavaScript-based command and control or input capture mechanisms, where attackers use browser-native scripting to harvest credentials or session cookies. Furthermore, this vulnerability maps closely to CWE-284, which describes Improper Access Control, as well as CWE-79, regarding Cross-Site Scripting if the flaw allows for script injection that bypasses origin checks. The consequence is a violation of confidentiality, potentially leading to account takeover, identity theft, or further lateral movement within an enterprise environment if session tokens are harvested.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.65 or later, where the authorization logic has been corrected to enforce strict origin checks on DOM operations. For organizations unable to patch immediately due to compatibility concerns, implementing Content Security Policy headers can provide a layer of defense by restricting which sources are allowed to execute scripts and access resources. Additionally, deploying browser extensions that enhance cross-origin isolation policies or using enterprise-grade security solutions that monitor for anomalous DOM manipulation patterns can help detect exploitation attempts in real-time. Users should also be educated on the risks of interacting with untrusted web content, as social engineering often accompanies such technical exploits to lure victims into visiting malicious pages designed to trigger this vulnerability.