CVE-2026-79185 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability described constitutes an information disclosure flaw within the Document Object Model implementation of Google Chrome, specifically affecting versions prior to 152.0.7977.65. This defect arises from improper handling of cross-origin data access mechanisms, allowing a remote attacker to circumvent standard web origin policies that are designed to isolate content from different sources. The core technical flaw lies in the browser's failure to strictly enforce separation between documents originating from distinct security contexts when processing specific HTML structures or script executions within the DOM tree. By crafting a malicious webpage containing specially constructed elements and scripts, an attacker can exploit this logic error to read sensitive data belonging to other origins that would normally be inaccessible due to the Same-Origin Policy restrictions enforced by modern web browsers.
From a technical perspective, this vulnerability represents a breakdown in the isolation guarantees provided by the browser's security sandbox. The DOM serves as the interface through which scripts interact with webpage content, and when origin checks are bypassed during specific parsing or rendering operations, data intended for one context becomes visible to another. This type of flaw is commonly categorized under CWE-200, which covers Information Exposure, specifically falling into subcategories related to exposure of sensitive information to unauthorized actors via web application interfaces. The exploitation vector relies on social engineering or drive-by download tactics where a victim visits the crafted HTML page, triggering the browser's rendering engine to execute code that leverages the DOM inconsistency to extract cookies, local storage data, or other session-specific artifacts from protected origins.
The operational impact of this vulnerability is significant for users relying on Chrome for sensitive activities such as online banking, email access, or corporate portal usage. An attacker who successfully exploits this flaw can perform cross-site scripting-like attacks without needing to inject scripts into the target site itself. Instead, they act as a man-in-the-middle within the client-side environment, reading data that should remain private. This compromises user confidentiality and integrity, potentially leading to account takeover if session tokens are harvested or sensitive personal information is exfiltrated. The Chromium security team classified this issue with medium severity because while it does not allow for arbitrary code execution on the host system, its ability to bypass fundamental web isolation principles poses a substantial risk to data privacy across millions of users until patched.
Mitigation strategies primarily involve immediate software updates. Users must upgrade Google Chrome to version 152.0.7977.65 or later where these DOM origin checks have been corrected and hardened against such bypass techniques. For organizations deploying Chrome via enterprise policies, ensuring automatic update mechanisms are enabled is critical to minimize the window of exposure. Additionally, security awareness training should emphasize that visiting untrusted websites carries inherent risks even with up-to-date browsers, as zero-day vulnerabilities may exist before patches are released. Implementing Content Security Policy headers on web applications can also provide an additional layer of defense by restricting how resources are loaded and executed, thereby reducing the attack surface available to attackers attempting to leverage DOM-based information leaks for malicious purposes.