Inadequate Encryption Strength in Google Chrome Notifications

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Chrome

Description

Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-25

Generated

2026-08-26

AI Q&A

2026-08-26

EPSS Evaluated

N/A

NVD

CVE-2026-79084

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 152.0.7977.65 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-326	The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Attack-Flow Graph

Executive Summary

This vulnerability involves inadequate encryption strength in the Notifications feature of Google Chrome on Windows. It allows a remote attacker to bypass web origin policy by tricking a user into visiting a crafted HTML page through social engineering tactics.

Impact Analysis

An attacker could exploit this to bypass security restrictions, potentially accessing sensitive data or performing unauthorized actions on behalf of the user. Social engineering is required, meaning the attacker must deceive the user into interacting with the malicious page.

Mitigation Strategies

Update Google Chrome to version 152.0.7977.65 or later to address the inadequate encryption strength in Notifications.

Hi! I’m here to help you understand CVE-2026-79084. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70