CVE-2026-79068

Received Received - Intake

Improper Resource Exposure in Google Chrome StreamsAPI

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Chrome

Description

Improper resource exposure in StreamsAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-25

Generated

2026-08-26

AI Q&A

2026-08-26

EPSS Evaluated

N/A

NVD

CVE-2026-79068

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	152.0.7977.65

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper resource exposure in the StreamsAPI of Google Chrome before version 152.0.7977.65. A remote attacker could exploit a crafted HTML page to bypass the web origin policy and access a privileged page.

Impact Analysis

An attacker could use this flaw to gain unauthorized access to sensitive pages or data within Chrome, potentially leading to data theft, session hijacking, or further exploitation of the user's system.

Compliance Impact

This vulnerability could lead to unauthorized data access, which may violate GDPR's data protection principles or HIPAA's security requirements for protected health information, depending on the context of use.

Mitigation Strategies

Update Google Chrome to version 152.0.7977.65 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-79068. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70