CVE-2026-79271 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an information leak within the Document Object Model of Google Chrome prior to version 152.0.7977.65 represents a significant breach in browser-side isolation mechanisms. This flaw allows for the unauthorized exfiltration of sensitive data that should remain confined to specific browsing contexts or protected memory spaces. The core technical issue stems from improper handling of DOM elements, where state management or property access controls fail to adequately restrict cross-origin or privileged script interactions. When a malicious actor crafts an HTML page designed to exploit this weakness, they can manipulate the browser's rendering engine and JavaScript execution environment to read data that is not intended for public consumption. This typically involves accessing properties of window objects, iframe contents, or other DOM nodes that are subject to stricter security policies such as the Same-Origin Policy. The failure lies in the specific implementation details of how these boundaries are enforced during runtime operations, allowing a script loaded from an untrusted source to bypass expected restrictions and retrieve internal state information.
The operational impact of this vulnerability is primarily driven by its reliance on social engineering tactics for exploitation. Since the attack vector requires the victim to visit a crafted HTML page, it does not constitute a fully remote zero-click exploit but rather targets user interaction. An attacker would need to deceive a target into navigating to a malicious website or opening an email attachment that triggers the loading of this specific payload. Once executed within the context of Chrome's rendering process, the vulnerability enables the extraction of sensitive information such as session tokens, authentication cookies, personal identifiable information stored in local storage, or other data accessible via the DOM API. This compromises user privacy and can lead to account takeover if session identifiers are stolen. The severity is classified as medium because while it facilitates significant data leakage, it requires active user participation and does not allow for arbitrary code execution on the host system directly through this specific flaw alone.
From a classification perspective, this vulnerability aligns with CWE-200, which defines an Information Exposure where sensitive information is disclosed to unauthorized actors. It also relates closely to CWE-798, involving the use of hardcoded credentials or access tokens that are inadvertently exposed due to poor security controls in client-side applications. In terms of offensive cybersecurity frameworks like MITRE ATT&CK, this behavior maps to T1056, specifically the component related to Input Capture such as Keylogging or Screen Capture if the DOM leak allows for broader context reading, but more accurately it fits under data exfiltration techniques where sensitive information is gathered from local system resources. The attack chain involves initial access via social engineering, followed by execution of malicious scripts in a sandboxed environment that fails to properly isolate data scopes, leading to unauthorized data retrieval and potential lateral movement if the stolen credentials are used elsewhere.
Mitigation strategies for this vulnerability focus on both immediate patching and long-term architectural improvements. The primary defense is upgrading Google Chrome to version 152.0.7977.65 or later, where the Chromium team has addressed the underlying DOM handling logic that permitted the leak. For organizations managing large fleets of browsers, deploying automated update policies ensures rapid remediation across all endpoints. Additionally, implementing Content Security Policy headers can help restrict the sources from which scripts are allowed to execute and interact with the DOM, thereby reducing the attack surface even if similar vulnerabilities exist in older versions. Developers should also adhere to strict Same-Origin Policy enforcement principles during application development, ensuring that sensitive data is not stored in easily accessible global variables or DOM properties without adequate encryption or obfuscation layers. Regular security audits of client-side code and continuous monitoring for anomalous script behavior can further enhance resilience against such information disclosure attacks.