CVE-2026-79272
Summary
by MITRE • 08/26/2026
Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an improper input validation flaw within the FindInPage component of Google Chrome prior to version 152.0.7977.65 represents a significant breach in cross-origin isolation mechanisms. This issue stems from insufficient sanitization and boundary checks when processing search queries or navigation parameters initiated by the renderer process. In modern browser architectures, particularly those utilizing Chromium's multi-process design, strict separation of privileges is maintained between different contexts to prevent data leakage. The FindInPage feature, responsible for handling in-page text searches, inadvertently exposed a pathway where malformed or crafted input could bypass these isolation boundaries. This flaw allows an attacker who has already achieved code execution within the renderer process, typically through exploitation of another vulnerability such as a sandbox escape or a malicious script injection, to interact with page content across different origins without proper authorization checks.
From a technical perspective, this vulnerability aligns closely with CWE-20 Improper Input Validation and CWE-94 Cross-Site Scripting if the input leads to code execution, but more specifically it relates to CWE-359 Exposure of Private Information Through Shared State or Context when considering the cross-origin data leak aspect. The core issue lies in how the browser handles state transitions and content retrieval during a find operation across frames that belong to different security origins. When an attacker crafts a specific HTML page designed to trigger this flaw, they can manipulate the internal pointers or memory structures used by FindInPage to access resources from other domains. This bypasses the Same-Origin Policy which is fundamental to web security, allowing the compromised renderer to read sensitive data such as cookies, local storage contents, or dynamic content loaded via AJAX requests from third-party sites embedded within the victim's browser session.
The operational impact of this vulnerability is severe for users who browse with multiple tabs open containing sensitive information from various services like banking portals, email clients, or enterprise dashboards. An attacker leveraging this flaw can exfiltrate confidential data that was previously considered safe due to origin boundaries. This capability effectively neutralizes one of the primary defenses against cross-site data theft. The severity is rated as Medium by Chromium security standards because while it requires a pre-existing compromise in the renderer process, such compromises are relatively common vectors for advanced persistent threats and drive-by download attacks. Once inside the renderer, gaining access to cross-origin data significantly increases the attacker's ability to perform identity theft, session hijacking, or further lateral movement within the user's digital environment.
Mitigation strategies primarily involve upgrading Google Chrome to version 152.0.7977.65 or later where these input validation checks have been hardened and cross-origin isolation policies are strictly enforced during find operations. For organizations managing large fleets of endpoints, ensuring automatic update mechanisms are active is critical to patching this exposure promptly. Additionally, security teams should monitor for indicators of compromise that suggest renderer process exploitation attempts, such as unusual memory access patterns or unexpected network requests originating from browser processes. Implementing Content Security Policy headers can also help mitigate the impact by restricting how resources are loaded and executed, thereby reducing the attack surface available to an attacker who might attempt to exploit this specific input validation flaw. The ATT&CK framework classifies this type of behavior under T1059 Command and Scripting Interpreter if it involves script-based exploitation or T1074 Data Staged if the leaked data is being collected for later exfiltration, highlighting the need for endpoint detection systems to flag anomalous browser activity consistent with cross-origin data scraping.