CVE-2026-79291 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an information leak within the Cascading Style Sheets engine of Google Chrome, specifically affecting versions prior to 152.0.7977.65, represents a significant breach in browser-side isolation mechanisms. This flaw allows a remote attacker to extract sensitive data that should remain inaccessible through standard web browsing interactions. The core issue stems from how the rendering engine processes and applies CSS rules during page layout calculations. When an attacker crafts a malicious HTML page containing specific, carefully constructed style definitions or DOM manipulations, they can exploit inconsistencies in how Chrome resolves styles for elements that are hidden, removed from the document flow, or otherwise not visually rendered to the user. This discrepancy between logical state and visual rendering creates a side-channel through which internal browser states or data associated with those elements can be inferred by malicious scripts running within the context of the crafted page.
From a technical perspective, this vulnerability falls under the category of improper access control where sensitive information is exposed via unintended channels. It aligns closely with CWE-200: Information Exposure and potentially CWE-359: Exposure of Private Personal Information to an Unauthorized Actor if personal data is involved. The attack vector relies on Cross-Site Scripting principles, although it does not necessarily require executing arbitrary code in the traditional sense. Instead, it leverages the browser's own rendering logic against itself. By observing timing differences or specific behavioral outputs triggered by CSS properties applied to hidden elements, an attacker can deduce the existence and content of data that is ostensibly protected from script access due to same-origin policy restrictions. This technique effectively bypasses standard security boundaries because the vulnerability exploits legitimate functionality rather than a failure in permission checks alone.
The operational impact of this vulnerability is primarily focused on privacy violations and potential credential theft if combined with other techniques such as phishing or session hijacking. An attacker hosting a malicious webpage could potentially determine whether specific user data, such as autofilled form fields, hidden authentication tokens, or sensitive content within shadow DOMs, exists in the victim's browser state. While the severity is classified as Medium by Chromium security standards, indicating that exploitation requires some level of interaction or specific conditions, it remains dangerous because it can be automated and scaled across many victims without direct engagement beyond visiting a compromised site. This capability undermines the fundamental trust users place in their browsers to isolate web content from each other and from local system resources.
Mitigation strategies for this vulnerability are primarily centered around timely software updates and defensive coding practices. Users must ensure that Google Chrome is updated to version 152.0.7977.65 or later, as the patch addresses the specific logic errors in the CSS engine responsible for these leaks. For developers integrating web technologies into applications, it is crucial to avoid relying on hidden elements for security-critical data storage. Sensitive information should never be stored in DOM attributes that can be accessed via style queries, even if those elements are visually obscured. Implementing strict Content Security Policy directives and ensuring proper sanitization of user input further reduces the attack surface. Additionally, browser vendors continue to harden rendering engines against such side-channel attacks by improving isolation between layout calculations and script execution contexts, thereby closing these information leakage paths permanently in future releases.