CVE-2026-79293 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an information leak within the animation subsystem of Google Chrome, specifically affecting versions prior to 152.0.7977.65, represents a significant risk to user privacy and data confidentiality. This flaw resides in the rendering engine responsible for processing CSS animations and JavaScript-driven visual effects. The core technical issue stems from improper handling or exposure of internal state variables during the animation lifecycle. When a maliciously crafted HTML page is loaded, it can trigger specific sequences within the animation pipeline that inadvertently expose memory contents or sensitive DOM properties to external scripts or observers. This type of vulnerability is classically categorized under CWE-200, which defines an Information Exposure flaw where software discloses information that should be restricted from unauthorized access. The severity is rated as Medium by Chromium security standards because while it does not allow for direct code execution, the ability to read sensitive data can facilitate further attacks or lead to significant privacy breaches depending on the context of the visited webpage and the user's session state.
From an operational perspective, this vulnerability allows a remote attacker to exploit the browser environment without requiring any interaction from the victim other than visiting a maliciously designed website. The attack vector is typically delivered via social engineering tactics where users are lured into clicking links or opening emails containing the crafted HTML page. Once executed, the script leverages the animation timing functions and property accessors to read data that should remain encapsulated within the browser's secure context. This could include sensitive form inputs, authentication tokens stored in local storage if accessible through specific DOM traversal techniques enabled by the leak, or other private variables associated with web applications running on the page. The impact is particularly severe for users who engage in online banking, healthcare portals, or any activity involving Personally Identifiable Information (PII), as the leaked data could be exfiltrated to an attacker-controlled server via standard HTTP requests initiated by the malicious script.
In terms of threat modeling and industry frameworks, this vulnerability aligns with ATT&CK technique T1056, which covers Input Capture, specifically through keylogging or screen capture mechanisms if the animation leak allows for reading input field values in real-time. It also relates to data exfiltration techniques where sensitive information is gathered from local systems before being sent out of the network boundary. The lack of proper sandboxing isolation during certain high-frequency animation updates creates a window of opportunity for cross-origin read bypasses or similar privilege escalation within the browser's multi-process architecture. This underscores the importance of strict separation between untrusted web content and sensitive internal APIs, ensuring that even if an attacker gains execution context on a page, they cannot easily access privileged data structures without explicit permission checks being enforced at every step of the animation processing pipeline.
Mitigation for this vulnerability primarily involves updating Google Chrome to version 152.0.7977.65 or later, where the underlying code has been patched to enforce stricter boundaries on what information can be exposed during animation updates. For organizations managing large fleets of devices, automated patch management systems should be configured to prioritize browser security updates due to their widespread use and high attack surface. Additionally, users are advised to enable automatic update notifications within Chrome settings to ensure they receive patches promptly upon release. From a defensive posture perspective, implementing Content Security Policy (CSP) headers can help mitigate the impact of such exploits by restricting the sources from which scripts can load data or make network requests, thereby reducing the effectiveness of any exfiltration attempts even if the initial information leak occurs. Regular security audits and penetration testing that include browser-based attack simulations are also recommended to identify similar implementation flaws in custom web applications before they can be exploited in the wild.