CVE-2026-78979

Analyzed Analyzed - Analysis Complete

Race Condition in Google Chrome on Windows

Publication date: 2026-08-25

Last updated on: 2026-08-28

Assigner: Chrome

Description

Race condition in Core in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-28

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-78979

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 152.0.7977.65 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This is a race condition vulnerability in Google Chrome's Core component on Windows systems before version 152.0.7977.65. A race condition occurs when the behavior of a system depends on the sequence or timing of uncontrollable events. In this case, it allowed a remote attacker to bypass web origin policy through a crafted HTML page, potentially tricking users into interacting with malicious content.

Detection Guidance

This vulnerability involves a race condition in Google Chrome on Windows. Detection requires checking Chrome version against 152.0.7977.65. Use chrome://settings/help to check for updates or run 'google-chrome --version' in terminal. If version is below 152.0.7977.65, the system is vulnerable.

Impact Analysis

This vulnerability could allow an attacker to bypass security restrictions, potentially leading to unauthorized access to sensitive data or actions on behalf of the user. The attacker would need to trick the user into visiting a specially crafted webpage, making social engineering a key factor in exploitation.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a race condition in Google Chrome that allows bypassing web origin policy through social engineering. No evidence suggests it impacts data protection or privacy controls required by these regulations.

Mitigation Strategies

Update Google Chrome to version 152.0.7977.65 or later to address the race condition vulnerability.

Hi! I’m here to help you understand CVE-2026-78979. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70