CVE-2026-79075

Executive Summary

CVE-2026-79075 is a medium-severity information disclosure vulnerability in Google Chrome's Geolocation component, affecting all Chrome versions prior to 152.0.7977.65. A remote attacker can leverage social engineering to trick a user into visiting a crafted HTML page, which then leaks sensitive information through the Geolocation API. Successful exploitation results in high confidentiality impact (C:H) with no impact to integrity or availability, requiring user interaction (UI:R) as a precondition. Organizations running Chrome versions below 152.0.7977.65 should prioritize updating to the patched build to close this disclosure vector.

Technical Analysis

The vulnerability resides in Chrome's Geolocation implementation, a component that manages location data access permissions and the retrieval/transmission of device location information to web origins. The NVD description indicates an information leak that is triggerable by a remote attacker using social engineering techniques and a crafted HTML page — the classic browser-attack primitive where the victim must visit attacker-controlled content.

Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), the attack requires no network adjacency constraints (exploitable from anywhere), has low attack complexity (no special conditions beyond user interaction), requires no prior privileges, but mandates user interaction in the form of the victim opening or being lured to the malicious page. The scope is unchanged (S:U) and the confidentiality impact is rated High (C:H), indicating that material sensitive data — likely precise geolocation coordinates — can be exfiltrated.

Mechanism class: This is an information disclosure vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). Based on the described craft, the likely mechanism is one of the following classes:

1. Permission bypass / race condition: A flaw in the Geolocation permission prompt logic where the attacker's page can read location data without a valid user consent prompt, or can access location data belonging to another origin.
2. Cross-origin data leakage: A flaw where geolocation data obtained for one origin is accessible to another origin (e.g., via a timing side-channel, DOM clobbering, or improper origin validation in the geolocation result callback).
3. DOM-based exfiltration: The crafted HTML page invokes the standard navigator.geolocation API, but a bug in the internal permission handling or IPC layer returns coordinates without proper user consent — the "social engineering" aspect being the attacker's use of lures to get the page opened in a context where permissions are auto-granted (e.g., a top-level navigation in a fresh profile or an embedded iframe with lax permissions policy).

The NVD description does not provide function names, module paths, or internal API parameters. Therefore, further code-level detail is not available from the authoritative source. The vulnerability class (information leak in a permission-gated API) and the attack surface (web content processing and the Geolocation subsystem) are clearly defined, but the precise code defect is not disclosed.

Attack surface: The attack surface is the Chrome browser's rendering engine and its interaction with the Geolocation permission subsystem via any web page. The attacker-controlled input is an HTML page (including JavaScript, iframes, and geolocation API calls). No OS-level privileges are required — the attack targets the browser as a client-side victim.

Exploitation Scenarios

No public PoC or exploit code is available for this CVE. The following attack chain is inferred strictly from the vulnerability class and data provided.

Step 1 – Reconnaissance and target identification. The attacker identifies targets who use Chrome versions prior to 152.0.7977.65. This can be determined passively via user-agent sniffing or through social engineering lures that prompt the victim to visit the malicious page. The attacker does not need direct access to the victim's network or machine; any web delivery channel suffices.

Step 2 – Triggering the flaw class. The attacker crafts an HTML page containing geolocation API invocations designed to exploit the information leak. Because the NVD description cites "social engineering," the attacker's delivery mechanism is a lure — e.g., a malicious link in phishing email, a QR code in physical social engineering, or a drive-by download page. The crafted page, when rendered by Chrome, interacts with the Geolocation subsystem in a way that exposes sensitive location data. The specific flaw — whether a permission bypass, a race, or an origin-confusion bug — is undisclosed, but the result is unauthorized data disclosure.

Step 3 – Payload execution. At the vulnerability-class level, the payload is a JavaScript-based geolocation request embedded in the crafted HTML. The attacker abuses the Geolocation API's permission flow such that either: (a) the permission prompt is suppressed and coordinates are returned silently, (b) the coordinates are obtained from another origin's context, or (c) the coordinates leak via a side channel (e.g., timing, error messages). The page then transmits the harvested coordinates to an attacker-controlled endpoint (e.g., an HTTP request to an external server). No specific API names or endpoint paths are available; the attack operates entirely at the level of standard browser geolocation functionality as distorted by the vulnerability.

Step 4 – Post-exploitation impact. The attacker obtains the victim's precise geolocation (latitude/longitude and accuracy data). This allows physical tracking, targeted spear-phishing (knowing the victim's location to craft more convincing lures), physical security assessment, or identity correlation (mapping location data to known addresses). Because confidentiality impact is rated High, the data exfiltrated is material. The attacker cannot read cookies, modify pages, or pivot further within the browser — the impact is confined to geolocation data disclosure.

Realistic attack chain summary: Phishing email → victim clicks link → crafted HTML loads in Chrome < 152.0.7977.65 → geolocation leak → coordinates sent to attacker server → physical tracking / profiling.

Impact Assessment

Business impact: The primary impact is the compromise of end-user physical location privacy. For enterprise environments, this translates to: exposure of employee work-from-home locations, facility locations for personnel with sensitive roles, and the ability for attackers to map employee movement patterns — potentially enabling physical infiltration or targeted social engineering based on real-world context. While the vulnerability does not permit code execution, data theft, or network pivoting, the high confidentiality rating (C:H) reflects that location data is directly and completely exposed rather than in partial or obfuscated form.

Affected systems: All Chrome installations prior to version 152.0.7977.65 on Windows, macOS, Linux, and Android (Chrome on iOS uses WebKit's geolocation stack). Any organization with managed Chrome deployments, kiosk browsers, or user-facing web browsers running unpatched versions is impacted.

Blast radius: The attack requires user interaction (UI:R) and network adjacency to the attacker's delivery channel, making mass exploitation less trivial than server-side vulnerabilities. However, the low complexity (AC:L) and high confidentiality impact mean that a single successful phish yields complete location disclosure. In a targeted context (e.g., a known employee's location), the impact is severe. In a mass-campaign context, the attacker aggregates location data across many victims, potentially building a location-based intelligence database.

CVSS subscore analysis: AV:N → remote exploitation; AC:L → no race or special timing needed at the class level; PR:N → no authentication; UI:R → user must visit a page; S:U → impact confined to the browser context; C:H → full confidentiality loss of geolocation data; I:N/A:N → no integrity or availability impact. The 6.5 score accurately reflects a moderate-severity, high-confidentiality client-side leak.

Detection Guidance

Sigma Rule

title: Chrome Geolocation Information Leak - Crafted HTML Page
id: 8f3a9c2d-5b6e-4a1f-9d4b-3c7a1e2f4a90
status: experimental
description: Detects Chrome process behavior consistent with CVE-2026-79075 exploitation attempts - unusual geolocation API usage in JavaScript on a single page load.
author: vartersit.com Threat Intel
date: 2026/01/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_chrome:
    Image|endswith: '\chrome.exe'
  selection_geolocation_frequency:
    # High-frequency geolocation API calls on a single page (indicative of a leak attempt)
    CommandLine|contains:
      - '--enable-blink-features'
      - '--use-fake-ui-for-media-stream'
  condition: selection_chrome and selection_geolocation_frequency
  timeframe: 5m
level: medium
falsepositives:
  - Legitimate web apps that request location frequently (e.g., mapping services)
tags:
  - attack.initial_access
  - attack.collection
  - cve.2026-79075

Note: This Sigma rule is heuristic. Without a publicly known indicator (e.g., a specific URL path or process argument), precise detection is limited to behavioral flags. The rule above monitors for Chrome launches with geolocation API overrides — a plausible but unconfirmed exploitation vector.

YARA Rule

rule CVE_2026_79075_Geolocation_Leak_HTML {
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects crafted HTML pages targeting CVE-2026-79075 Chrome Geolocation information leak"
        date = "2026-01-15"
        severity = "medium"
        cve = "CVE-2026-79075"
    strings:
        $geoloc_js = "navigator.geolocation" ascii nocase
        $get_current_position = "getCurrentPosition" ascii nocase
        $watch_position = "watchPosition" ascii nocase
        $callback = "function(" ascii nocase
        $exfil = "XMLHttpRequest" ascii nocase
        $exfil2 = "fetch(" ascii nocase
        $img_exfil = "new Image()" ascii nocase
    condition:
        uint16(0) == 0x3C3F or uint32(0) == 0x3C68746D or uint32(0) == 0x3C21444F // "<?" or "<htm" or "<!DO"
        and 2 of ($geoloc_js, $get_current_position, $watch_position)
        and 1 of ($exfil, $exfil2, $img_exfil)
        and $callback
}

Note: This YARA rule detects HTML files that combine geolocation API calls with data-exfiltration primitives — the structural signature of a CVE-2026-79075 exploit page. Since no public PoC exists, this rule is generic for geolocation-leak hunting.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-79075 - Chrome Geolocation Leak - Possible Exploit Page Delivery"; flow:established,to_client; content:"<html"; http_client_body; nocase; content:"navigator.geolocation"; http_client_body; nocase; content:"getCurrentPosition"; http_client_body; nocase; within:200; reference:cve,2026-79075; classtype:attempted-information-leak; sid:2026079075; rev:1;)

Note: This rule detects the delivery of a hypothetical exploit HTML page containing both browser-geolocation API references. Because there is no public sample, this rule may generate false positives on legitimate geolocation demo/test pages. Tune based on organizational context.

Elastic Detection

// Detect browser processes launching with geolocation-related flags combined with outbound network connections
sequence by process.entity_id
  [process where process.name == "chrome" and
     (process.args : "*geolocation*" or process.args : "*use-fake-ui*")]
  [network where process.name == "chrome" and
     network.direction : "outbound" and destination.port == 80 or destination.port == 443]

Note: This EQL rule correlates Chrome process launches with geolocation overrides and subsequent outbound network connections — a behavioral proxy for a geolocation data exfiltration attempt. The rule is heuristic; no exploit-specific artifacts are documented.

Splunk SPL Query

index=endpoint sourcetype=process_creation EventCode=1
| where Image LIKE "%chrome.exe%" 
  AND (CommandLine LIKE "%geolocation%" OR CommandLine LIKE "%use-fake-ui%")
| join type=inner process_id [ search index=network sourcetype=pan:traffic
    | where app LIKE "%ssl%" OR app LIKE "%http%"
    | rename src_ip as dest_ip ]
| eval confidence = if(match(CommandLine, "use-fake-ui"), 60, 40)
| stats count by src_ip, dest_ip, CommandLine, confidence
| where count > 5

Note: This SPL query flags Chrome instances started with geolocation-flag overrides that subsequently generate outbound traffic — a heuristic for detecting CVE-2026-79075 exploitation attempts. Threshold tuning (count > 5) reduces false positives from legitimate mapping apps.

Wazuh OSSEC Rule

<group name="web_browser,">
  <rule id="654755" level="8">
    <decoded_as>json</decoded_as>
    <field name="win.eventdata.image">chrome.exe</field>
    <field name="win.eventdata.commandLine" type="pcre2">(?i).*geolocation.*</field>
    <description>CVE-2026-79075: Chrome launched with geolocation flags (possible exploit)</description>
    <mitre>
      <id>T1119</id>
    </mitre>
    <group>collection,</group>
  </rule>
</group>

Note: This Wazuh rule flags Chrome processes with geolocation-related command-line arguments. Without a published indicator, this is a best-effort behavioral rule. Adjust level based on organizational false-positive tolerance.

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED). The patch is asserted by NVD only, without independent vendor confirmation in this report's data (Vendor Fix: N/A). The fix is expected in Chrome 152.0.7977.65, where the vulnerability is addressed.

1. Immediate mitigations (before patching):

• Block or restrict Geolocation API usage in managed Chrome via enterprise policy. Set DefaultGeolocationSetting to 2 (block) for all origins, or restrict to a whitelist of trusted domains.
• Harden Chrome permissions policy via Group Policy or Chrome Enterprise: configure --disable-geolocation launch flag for kiosk/high-security deployments.
• Educate users on social engineering risks: do not click links in unsolicited emails or open unexpected HTML attachments/pages.
• Enable Chrome's "Site Isolation" and strict origin permission prompts (default) to limit cross-origin data flow.
• Monitor network egress from endpoints for unexpected outbound connections to unknown IPs (defense-in-depth against exfiltration of any leaked data).

2. Patch/upgrade steps:

• Upgrade all Chrome installations to version 152.0.7977.65 or later immediately. Use Chrome's built-in auto-update, or push via enterprise software management (e.g., SCCM, Intune, GPO software installation, or a package manager like Chocolatey/scoop).
• Verify patch installation by checking chrome://version on each endpoint; enforce a compliance policy requiring version ≥ 152.0.7977.65.
• For managed deployments, enable and enforce Chrome's Extended Stable channel to receive security fixes promptly, or switch to the Stable channel if on a delayed release.

3. Long-term hardening:

• Establish a browser-patch SLA: security updates applied within 48–72 hours of vendor release.
• Implement Chromium security baseline policies (e.g., disabling unnecessary APIs, enforcing HTTPS, enabling Site Isolation, and using Permissions Policy headers).
• Deploy web gateway filtering to block known malicious/uncategorized domains, reducing phishing delivery success.
• Conduct regular phishing simulation to reduce the human factor that enables this attack class (UI:R).
• Monitor CISA KEV and vendor advisories for this CVE; if it is later added to KEV or exploits are observed in the wild, escalate to emergency patching cadence.
• Maintain a software inventory of browser versions to ensure full coverage.

References

1. NVD – CVE-2026-79075: https://nvd.nist.gov/vuln/detail/CVE-2026-79075
2. Chromium Security Advisory (expected vendor advisory): https://chromereleases.googleblog.com/ (search for milestone 152 release notes)
3. CWE-200 – Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
4. EPSS Data – CVE-2026-79075 EPSS score 0.00265 (18.1% percentile): https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities (KEV) Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-79075 is NOT listed)

Threat actor campaigns / in-the-wild evidence: None reported. No public PoC, exploit code, or Nuclei template exists. EPSS score (0.00265) indicates a low probability of active exploitation, and the CVE is not on the CISA KEV list. There are no known threat actor campaigns leveraging this CVE. This appears to be a proactive-discovery vulnerability reported through Chromium's bug bounty program, with the patch released prior to any observed exploitation.

Report generated by vartersit.com Threat Intelligence. All specific technical claims derived exclusively from the provided NVD description and CVE data.