CVE-2026-79246 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in DataTransfer in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an information leak within the DataTransfer object of Google Chrome, specifically affecting versions prior to 152.0.7977.65, represents a significant breach in browser-side data isolation mechanisms. This flaw allows a remote attacker to extract sensitive user data through the manipulation of HTML pages crafted with specific malicious scripts. The core technical issue lies in how the DataTransfer interface handles clipboard operations and drag-and-drop events when interacting with content from different origins or contexts that should remain strictly isolated. In standard web security models, browsers enforce strict same-origin policies to prevent one webpage from accessing data belonging to another unless explicitly permitted by user interaction or specific API permissions. However, this vulnerability exploits a logic error in the implementation of the DataTransfer object, where sensitive information such as clipboard contents, file paths, or internal state variables are inadvertently exposed during certain asynchronous operations or event handlers.
From a technical perspective, the flaw stems from improper validation and sanitization of data passed through the DataTransfer API when triggered by user actions like copying text or dragging files. An attacker can construct an HTML page that tricks a victim into performing these interactions while simultaneously injecting malicious JavaScript to intercept the resulting data object before it is properly cleared or restricted. This interception allows the script to read properties such as types, items, and potentially sensitive metadata associated with the transferred data. The severity of this issue is classified as Low by Chromium security standards because it typically requires user interaction to trigger, meaning an attacker cannot purely exploit this vulnerability through passive browsing alone. Nevertheless, when combined with social engineering tactics or other vulnerabilities that lower user defenses, such as phishing pages designed to mimic legitimate services, the risk escalates significantly.
The operational impact of this information leak is primarily centered around privacy violations and potential credential theft. If a victim copies sensitive text containing passwords, API keys, or personal identification numbers from one application or website and then visits a malicious site crafted by an attacker, that data could be exfiltrated to the attacker's server without the user's knowledge. This undermines the fundamental trust users place in their web browsers as secure environments for handling confidential information. Furthermore, if file paths are exposed, it may aid attackers in mapping local system structures or identifying specific files of interest, facilitating further targeted attacks such as ransomware deployment or data exfiltration campaigns. The ability to read clipboard contents is particularly dangerous given the widespread use of password managers and multi-factor authentication codes stored temporarily in memory for user convenience.
To mitigate this risk, users must ensure that their Google Chrome browser is updated to version 152.0.7977.65 or later, where these logic errors have been patched by implementing stricter checks on data access permissions within the DataTransfer object. Security administrators should enforce automatic update policies across all endpoints to minimize exposure windows. Additionally, users can adopt defensive browsing habits such as disabling JavaScript for untrusted sites using browser extensions like NoScript, which prevents malicious scripts from executing and intercepting clipboard events. It is also advisable to clear clipboard contents regularly after handling sensitive information to reduce the window of opportunity for exploitation. From a broader security architecture standpoint, this vulnerability highlights the importance of continuous auditing of web APIs against evolving threat models that seek to bypass isolation boundaries through subtle implementation flaws rather than direct memory corruption techniques.
In terms of industry standards and classification frameworks, this vulnerability aligns with CWE-200: Information Exposure, as it involves the unintended disclosure of information to an unauthorized actor. It also relates to CWE-798: Use of Hard-coded Credentials if sensitive data like API keys are involved in the leaked payload, although the primary vector is general information leakage. Within the MITRE ATT&CK framework, this activity falls under T1056: Input Capture, specifically the Clipboard Data component, where attackers aim to capture keystrokes or copied text for later analysis and exploitation. Understanding these classifications helps security teams prioritize patching efforts and monitor for indicators of compromise associated with data exfiltration attempts leveraging browser-side vulnerabilities. The resolution in newer Chrome versions reinforces best practices in secure coding by ensuring that sensitive data objects are properly sanitized and restricted from unauthorized script access, thereby maintaining the integrity of the browsing environment against sophisticated social engineering attacks.