CVE-2026-79258 Google CVE debrief

Who should care

Users of Google Chrome, particularly those who may be targeted by social engineering attacks, should be aware of this vulnerability and take steps to mitigate it. This includes updating Google Chrome to version 152.0.7977.65 or later and implementing compensating controls to prevent social engineering attacks. IT teams and security professionals responsible for managing Google Chrome deployments should prioritize patching and monitoring for suspicious activity. Additionally, operators and administrators of systems that rely on Google Chrome for critical functions should review their exposure and implement additional security measures as needed. Security teams should also review their vulnerability management processes to ensure that similar vulnerabilities are addressed promptly in the future. Lastly, end-users who use Google Chrome for browsing should be cautious of potential social engineering attacks and report suspicious activity to their IT teams promptly.

Technical summary

The vulnerability, CVE-2026-79258, is caused by incorrect authorization in WebXR in Google Chrome prior to version 152.0.7977.65. This allows a remote attacker to obtain cross-origin data via a crafted HTML page, leveraging social engineering. The vulnerability has a CVSS score of 6.5 and is classified as Medium severity. Affected users should update Google Chrome to version 152.0.7977.65 or later.

Defensive priority

Medium severity vulnerability in Google Chrome, requiring social engineering for exploitation.

Recommended defensive actions

• Apply the official patch to update Google Chrome to version 152.0.7977.65 or later.
• Monitor for suspicious activity and implement compensating controls to prevent social engineering attacks.
• Inventory checks to ensure all Google Chrome instances are updated.

Evidence notes

Official CVE Program record and NVD vulnerability detail page confirm the vulnerability in Google Chrome prior to version 152.0.7977.65. The vulnerability allows a remote attacker to obtain cross-origin data via a crafted HTML page, leveraging social engineering. Evidence is limited to public sources and may not reflect the full scope of affected systems or potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.