CVE-2026-79208 in Chrome
Summary
by MITRE • 08/26/2026
Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as missing authorization within the HTTP/2 implementation of Google Chrome, specifically in versions prior to 152.0.7977.65, represents a critical failure in access control mechanisms at the protocol layer. This flaw allows for unauthorized data exfiltration by exploiting how the browser handles multiplexed streams and header compression states during HTTP/2 sessions. In standard web operations, browsers rely on strict same-origin policies and authorization headers to ensure that sensitive resources are only accessible to authenticated users or specific origins. However, in this instance, the parsing logic for HTTP/2 frames failed to properly validate whether a request was authorized before processing it or returning associated data. This oversight creates a scenario where an attacker can manipulate network traffic to trigger responses containing confidential information without possessing valid credentials or bypassing intended access controls.
From a technical perspective, the root cause lies in the handling of stream state and header validation within the Chromium engine's HTTP/2 stack. When establishing connections, browsers maintain complex states regarding open streams, window sizes, and priority settings. The vulnerability suggests that under specific conditions involving crafted network packets, the browser may process requests or return responses without verifying the necessary authorization tokens or origin checks. This is particularly dangerous because HTTP/2 allows multiple concurrent requests over a single connection, meaning an attacker could potentially interleave maliciously crafted frames to exploit race conditions or state confusion within the parser. The lack of rigorous validation at this low level means that sensitive headers, cookies, or response bodies intended for authenticated contexts might be exposed to unauthenticated parties who can craft specific network payloads to trigger these code paths.
The operational impact of this vulnerability is significant, primarily centering on information disclosure and potential session hijacking scenarios. An attacker positioned in a man-in-the-middle capacity or able to inject crafted traffic into the communication channel could extract sensitive user data such as authentication tokens, personal identifiable information, or proprietary application data. Since HTTP/2 is widely used for modern web applications that rely heavily on asynchronous data loading and real-time updates, the ability to leak this information undermines the confidentiality guarantees provided by HTTPS. Although the Chromium security severity was rated as Medium, indicating it may not allow direct code execution, the potential for large-scale data leakage remains high depending on the specific application context and the sensitivity of the data transmitted over HTTP/2 connections vulnerable to this flaw.
This issue aligns with CWE-862, which describes Missing Authorization, a fundamental category of access control flaws where an action is performed without proper verification of user permissions. Furthermore, in terms of adversary tactics, this vulnerability facilitates techniques associated with ATT&CK T1539, specifically Steal Web Session Cookie, as well as general data exfiltration methods like T1048 which involves Exfiltration Over Alternative Protocol. Attackers can leverage HTTP/2's multiplexing capabilities to blend malicious requests within legitimate traffic, making detection more difficult for traditional security monitoring tools that do not deeply inspect protocol-level state transitions and authorization checks.
To mitigate this risk, organizations must ensure that all instances of Google Chrome are updated to version 152.0.7977.65 or later where these access control validations have been corrected. For environments unable to update immediately due to compatibility constraints, implementing strict Content Security Policy (CSP) headers and ensuring robust server-side authorization checks can provide a secondary layer of defense by validating requests at the application level rather than relying solely on client-side enforcement. Additionally, network security teams should monitor for anomalous HTTP/2 traffic patterns that deviate from standard request-response behaviors, as such anomalies may indicate active exploitation attempts targeting this specific parsing flaw in older browser versions.