CVE-2026-79289 in Chrome
Summary
by MITRE • 08/26/2026
Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an improper control of resource lifetime within Google Chrome's Workers component represents a significant deviation from expected memory management protocols in multi-process web browsers. This flaw specifically affects versions prior to 152.0.7977.65 and centers on the lifecycle management of worker threads, which are essential for executing JavaScript code asynchronously without blocking the main UI thread. When a browser processes a crafted HTML page containing maliciously constructed Worker scripts, it fails to properly enforce constraints regarding when these resources should be allocated or deallocated. This lapse in resource control allows an attacker who has already achieved partial compromise of the renderer process to manipulate the state of these workers in ways that were not intended by the security architecture. The severity is classified as low within the Chromium framework because the initial access requires a pre-existing foothold, yet the implications for isolation boundaries are profound.
Site isolation is a critical defense mechanism employed by modern browsers like Chrome to prevent cross-site data theft through side-channel attacks or memory corruption vulnerabilities. By ensuring that each site runs in its own unique process with dedicated memory spaces, browsers aim to contain any potential breach within that specific context. However, the flaw described here undermines this containment strategy. An attacker leveraging this vulnerability can exploit the improper resource lifetime control to escape the sandboxed environment of a compromised renderer and interact with resources or processes associated with other origins. This effectively bypasses site isolation, allowing data from one origin to be accessed by another, thereby violating the principle of least privilege that underpins web security models. The ability to cross these boundaries means that sensitive information such as cookies, local storage contents, or session tokens could potentially be exfiltrated if combined with other exploitation techniques.
From a technical perspective, this issue aligns closely with CWE-401, which describes the improper release of memory or resources before they are no longer needed, and CWE-362, involving concurrent execution race conditions that may lead to resource misuse. In the context of browser architecture, these flaws often manifest when internal references to worker objects are not correctly nullified or tracked during process teardown or cross-origin navigation events. The attacker crafts an HTML page that triggers specific sequences in the Worker API, causing the browser to retain references to sensitive data structures longer than necessary or to allow access from unauthorized contexts due to stale pointers or incorrect state flags. This mismanagement creates a window of opportunity where the security boundary between different sites is blurred, enabling lateral movement within the user's browsing session.
The operational impact of this vulnerability extends beyond simple data leakage; it compromises the integrity of the entire browsing experience by eroding trust in site isolation guarantees. For enterprise environments relying on Chrome for secure web access, such vulnerabilities can facilitate phishing attacks where malicious scripts steal credentials from legitimate banking or corporate sites running in separate tabs or windows. Furthermore, because the attack vector involves a crafted HTML page delivered via standard web protocols, it is highly accessible to remote attackers without requiring user interaction beyond visiting a compromised website. This makes it particularly dangerous for users who may inadvertently navigate to malicious content through ads, redirects, or embedded iframes on otherwise legitimate sites.
Mitigation strategies primarily involve updating the browser software to version 152.0.7977.65 or later, where Google has addressed the underlying resource management logic in the Workers component. Administrators should ensure that automatic updates are enabled for all Chrome installations within their networks to minimize exposure windows. Additionally, organizations can employ strict Content Security Policy headers to restrict the execution of inline scripts and limit the sources from which workers can be loaded, thereby reducing the attack surface available to potential exploiters. Monitoring browser telemetry for unusual worker creation patterns or excessive memory usage in renderer processes may also help detect attempted exploitation activities before they result in successful site isolation bypasses.
In terms of threat intelligence frameworks, this vulnerability maps to MITRE ATT&CK technique T1059, specifically the execution of scripts via web browsers, and relates to defense evasion tactics where attackers manipulate system resources to avoid detection or escape sandboxes. The exploitation path demonstrates how low-severity flaws in core components can have high-impact consequences when they affect fundamental security boundaries like site isolation. Security teams should treat such vulnerabilities as critical indicators for patching urgency due to their potential role in broader attack chains that aim at data exfiltration and session hijacking. Continuous monitoring of browser update rollouts and enforcing strict web application security policies remain the most effective defenses against this class of memory management-related exploits.