Comprehensive Threat Intelligence Report: CVE-2026-79098

Executive Summary

CVE-2026-79098 is a UI misrepresentation vulnerability in the PermissionElement component of Google Chrome, affecting versions prior to 152.0.7977.65. A remote attacker leveraging social engineering tactics can spoof UI elements via a crafted HTML page, leading to a low-integrity impact where the victim is deceived into misinterpreting browser-permission interface elements. The vulnerability carries a Chromium security severity rating of "Low" with a CVSS base score of 4.3, requires user interaction, and has no known public exploits, PoC code, or inclusion in CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

CVE-2026-79098 resides in the PermissionElement component of Google Chrome. PermissionElement is the underlying browser subsystem responsible for rendering permission-related UI elements such as camera, microphone, geolocation, and notification prompt indicators that appear within web content.

The vulnerability classifies as CWE-451 (UI Misrepresentation of Critical Information), a weakness family that covers scenarios where the user interface fails to accurately represent critical security-relevant information to the user. In this case, an attacker can craft an HTML page that spoofs or misrepresents permission-related UI elements rendered by PermissionElement, causing the user to perceive the browser's permission state incorrectly.

The attack mechanism relies on:

1. UI Element Spoofing — The attacker constructs HTML/CSS content that visually imitates the native Chrome permission UI elements rendered by PermissionElement.
2. Social Engineering — Because the attack requires user interaction (per the CVSS vector UI:R), the attacker must first coax the victim into visiting the malicious page.
3. Network-Based Delivery — The attack vector is network-based (AV:N), meaning the malicious HTML page can be served from any web server, including legitimate-looking phishing sites or via malvertising campaigns.

Technical specifics that are NOT disclosed:

• The exact rendering flaw (e.g., whether it relates to CSS pixel manipulation, z-index stacking, iframe sandboxing quirks, or permission-policy interaction) is not described in the NVD entry.
• No specific function names, classes, or API endpoints are available in the public advisory data.
• The NVD description is sparse on implementation details, preventing a code-level analysis.

Attack surface:

• Any web page loaded in Chrome prior to 152.0.7977.65 can trigger the issue.
• The flaw impacts the integrity of the permission UI (C:I — None, C:A — None, C:I — Low), meaning the attacker can only misrepresent state; they cannot exfiltrate data or achieve code execution with this CVE alone.

CVSS Rationale:

• Scope: Unchanged (U) — the compromised component is the browser UI; no adjacent systems affected.
• Attack Complexity: Low (L) — requires no special conditions beyond serving a crafted page.
• Privileges Required: None (N).
• Integrity Impact: Low (L) — the UI can be visually spoofed, but the attacker does not directly modify browser data.

Patch details: According to the NVD entry, the fixed version is 152.0.7977.65. However, patch confidence is rated 2/4 (CLAIMED) — only a single source (NVD) confirms the patch existence, and it is not independently verified via vendor advisory cross-reference. Organizations should validate the fix by checking Chrome's built-in version string (chrome://version) against the patched build.

Exploitation Scenarios

Constraint: No public PoC or exploit code is available for CVE-2026-79098. The attack chain described below is inferred from the vulnerability class (CWE-451) and the NVD description.

Step 1 — Reconnaissance / Target Identification

The attacker selects targets who are likely to encounter permission prompts. This could involve:

• Mass phishing campaigns (email/SMS) directing victims to a crafted website.
• Watering-hole attacks targeting forums or websites frequented by the intended demographic.
• Malvertising delivered through ad networks.

No special target profiling is required because the attack works on any Chrome instance below the patched version.

Step 2 — Triggering the Vulnerability Class

The victim visits the attacker-controlled HTML page. The page contains crafted HTML/CSS that mimics the permission UI elements rendered by Chrome's PermissionElement. Because the UI misrepresentation flaw exists in the browser's rendering layer, the browser fails to distinguish between the legitimate permission prompt and the attacker's spoofed elements.

Step 3 — Payload / Execution (At Vulnerability-Class Level)

• Payload construction: The attacker creates CSS overlays, absolutely-positioned divs, or iframe-based elements that visually replicate the native Chrome permission indicator (e.g., a camera icon with "Allow" button).
• Spoofed state: The attacker presents a legitimate-looking permission prompt that requests camera/microphone access. However, the spoofed UI may:
  • Hide the actual permission request (by deferring the real prompt until after the spoofed one is dismissed).
  • Present a fake "allow" button that, when clicked, grants permissions to a hidden frame or different origin.
  • Mask the origin indicator, making the victim believe they are granting permission to a trusted site when they are not.
• User interaction: The victim must actively click the spoofed UI element. This satisfies the UI:R requirement in the CVSS vector.

Step 4 — Post-Exploitation Impact

• Impact scope: Integrity is compromised at the UI layer. The attacker may trick the user into granting browser permissions (e.g., camera, microphone, location, notifications) to a malicious origin.
• Consequential impact (not directly in this CVE, but plausible escalation): Once a permission is granted, the attacker could leverage subsequent legitimate browser APIs:
  • Notifications: Register for push notifications to deliver persistent phishing spam.
  • Camera/Microphone: Access the device's camera/microphone if the victim believes they are interacting with a legitimate service (e.g., fake video-call page).
  • Geolocation: Obtain the victim's physical location.
• Note: The CVE itself does not describe a mechanism for code execution, session theft, or credential exfiltration. Those would require chaining with other vulnerabilities or further social engineering.

Detection difficulty: Because the attack requires no malicious payload (just crafted HTML/CSS), network-layer detection is extremely challenging. The page content itself is static web code.

Impact Assessment

Real-world considerations:

• Enterprise risk: Medium-to-low. An attacker who successfully spoofs permission UI could gain permission access that might subsequently be abused. However, the single-interaction requirement limits automated mass exploitation.
• No KEV listing: The CISA Known Exploited Vulnerabilities catalog does not include this CVE, indicating there is no observed exploitation in the wild.
• EPSS score: 0.00174 (7.0% percentile) — this indicates a very low probability of exploitation in the near term.
• Likely abuse scenario: The most probable real-world use is in targeted social-engineering campaigns (e.g., fake tech-support scams, fake video-meeting invitations) where the attacker needs permission access (camera/mic) to complete the fraud.

Detection Guidance

Sigma Rule

title: Chrome PermissionElement UI Spoofing - Crafted HTML Indicators
id: 9f4c9a2e-1b3c-4d5e-8f6a-7b8c9d0e1f2a
status: experimental
description: Detects web content patterns commonly used to spoof Chrome permission UI elements (CVE-2026-79098)
author: Valtersit Threat Intel
date: 2026/07/01
logsource:
    category: proxy
    product: web
detection:
    selection_http:
        http.response.body|contains:
            - 'permission'
            - 'allow'
            - 'camera'
            - 'microphone'
    selection_js:
        http.response.body|contains:
            - 'getUserMedia'
            - 'Notification.requestPermission'
    selection_overlay:
        http.response.body|contains:
            - 'position:fixed'
            - 'position:absolute'
            - 'z-index:9999'
            - 'z-index:2147483647'
    condition: selection_http and selection_overlay and selection_js
level: medium
falsepositives:
    - Legitimate websites with camera/video features
    - Chrome extensions that inject overlays
tags:
    - attack.t1189
    - cve.2026.79098
    - cwe.451

YARA Rule

rule chrome_permissionelement_spoof_cve_2026_79098
{
    meta:
        author = "Valtersit Threat Intel"
        date = "2026-07-01"
        description = "Detects HTML patterns consistent with Chrome PermissionElement UI spoofing (CVE-2026-79098)"
        cvss = "4.3"
        cve = "CVE-2026-79098"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79098"
    strings:
        $permission = "permission" nocase
        $allow_btn = ">Allow<" nocase
        $block_btn = ">Block<" nocase
        $fixed_pos = "position:fixed" nocase
        $abs_pos = "position:absolute" nocase
        $zindex = "z-index:9999" nocase
        $zindex2 = "z-index:2147483647" nocase
        $media = "getUserMedia" nocase
        $notif = "Notification.requestPermission" nocase
    condition:
        uint16(0) == 0x3C21 and           // "<!" HTML header
        filesize < 200KB and
        (2 of ($permission, $allow_btn, $block_btn)) and
        (1 of ($fixed_pos, $abs_pos, $zindex, $zindex2)) and
        (1 of ($media, $notif))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-79098 Chrome PermissionElement UI Spoofing Attempt"; flow:established,to_client; content:"<html"; http_file_data; content:"permission"; http_file_data; nocase; content:"position:fixed"; http_file_data; nocase; content:"getUserMedia"; http_file_data; nocase; pcre:"/z-index\s*:\s*(?:2147483647|9999)/Ui"; classtype:attempted-user-admin; reference:cve,2026-79098; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79098; sid:2026790980001; rev:1;)

Note: This rule is intentionally broad and will generate false positives on legitimate video-conferencing sites. It should be run in alert-only mode and tuned per-organization.

Elastic Detection

// EQL query for Elastic SIEM
sequence by source.ip with maxspan=10s
  [ network where network.protocol == "http" and http.response.status_code == 200
    and url.extension == "html" ]
  [ file where event.action == "file-create"
    and file.extension == "html"
    and file.size < 200000
    and process.name == "chrome.exe"
    and file.path : "*\\Temp\\*" ]
  [ process where process.name == "chrome.exe"
    and event.action == "process-started"
    and process.args : "*--user-data-dir=*" ]

Alternative approach — static rule on downloaded HTML content:

any where process.name == "chrome.exe"
  and process.args : "*--user-data-dir=*"
  and process.parent.name : "chrome.exe"
  and event.action in ("process-started", "shell-execute")

Splunk SPL Query

index=proxy OR index=web
| where match(_raw, "(?i)permission") AND match(_raw, "(?i)(position:fixed|position:absolute|z-index:\s*(9999|2147483647))") AND match(_raw, "(?i)(getUserMedia|Notification\.requestPermission)")
| eval cve_id = "CVE-2026-79098"
| eval threat = "Chrome PermissionElement UI Spoofing"
| table _time, src_ip, dest_ip, url, http_user_agent, cve_id, threat
| sort - _time
| stats count by src_ip, dest_ip, url
| where count >= 1

Wazuh OSSEC Rule

<group name="chrome_permission_spoof,">
    <rule id="202698" level="8">
        <decoded_as>web</decoded_as>
        <field name="url">\.html</field>
        <match>permission|PermissionElement</match>
        <match>getUserMedia|Notification\.requestPermission</match>
        <regex>position\s*:\s*(fixed|absolute)</regex>
        <regex>z-index\s*:\s*(9999|2147483647)</regex>
        <description>Chrome PermissionElement UI spoofing attempt (CVE-2026-79098)</description>
        <mitre>
            <id>T1189</id>
        </mitre>
        <group>drive_by, cve_2026_79098, cwe_451,</group>
    </rule>

    <!-- Higher severity if beaconing detected after spoof attempt -->
    <rule id="202699" level="12">
        <if_sid>202698</if_sid>
        <match>permission|granted|allow</match>
        <description>Potential successful Chrome permission spoofing - user interaction with fake prompt (CVE-2026-79098)</description>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed))

1) Immediate Mitigations

2) Patch / Upgrade Steps

• Validate the patched version: Confirm that Chrome version is 152.0.7977.65 or later via chrome://version.
• For managed enterprise fleets: Deploy the latest stable Chrome channel via Google Update or gupdate policies. Example GPO: HKLM\SOFTWARE\Policies\Google\Update\UpdateDefault = 1 ensures auto-update.
• Manual update: Navigate to Chrome menu → Help → About Google Chrome → triggers automatic update check.
• Verify independently: Since patch confidence is 2/4, independently confirm the fix by testing a known spoof-proof permission flow (e.g., attempt to overlay a fake camera prompt after upgrade). If behavior persists, the "claimed" patch may be incomplete.

3) Long-Term Hardening

• Apply Chrome enterprise policy: Set BrowserGuestModeEnabled or WebRtcAllowLegacyTLSProtocols to reduce the attack surface for social-engineering-driven permission grants.
• Enable Chrome Browser Cloud Management: Provides real-time visibility into permission usage and allows remote revocation of risky permissions.
• Implement Zero-Trust browsing: Use remote-isolated browsing (e.g., cloud browser isolation) that strips active content delivery from untrusted sources.
• Periodic asset audits: Use Shodan-like dorking (http.title:"Chrome", product:"Chrome") in your own org to enumerate Chrome installations that may have auto-update disabled.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-79098 — Official CVE record with CVSS vector 4.3 and NVD description.
2. CWE-451 (UI Misrepresentation): https://cwe.mitre.org/data/definitions/451.html — Weakness class reference.
3. Chromium Security Severity Guide: https://www.chromium.org/Home/chromium-security/severity-guidelines — Reference for the "Low" severity rating.
4. Google Chrome Release Notes (152.x): https://chromereleases.googleblog.com/ — Track the 152.0.7977.65 stable channel release notes (when published).
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Confirmed: not listed.

Threat Actor Campaigns & In-the-Wild Evidence:

• No known threat actor campaigns have been attributed to CVE-2026-79098.
• No exploit-in-the-wild evidence — neither public PoC nor OSINT reporting indicates active exploitation.
• EPSS percentile (7.0%) confirms that the vulnerability is not currently a priority target for automated exploit tooling.

Report generated: 2026-07-01 | Classification: TLP:CLEAR | Author: Valtersit Threat Intelligence Team