CVE-2026-79242

Executive Summary

CVE-2026-79242 is a medium-severity information disclosure vulnerability in Google Chrome, present in all builds prior to version 152.0.7977.65. The flaw resides in the HTML rendering engine and stems from an observable discrepancy — a divergence between the intended and actual processing of crafted HTML content. A remote attacker can leverage this by directing a victim to a specially constructed HTML page, which then facilitates the exfiltration of sensitive information. The attack requires user interaction (navigating to the malicious page) and is rated as having high attack complexity, meaning successful exploitation is conditional on specific environment or timing factors. The confidentiality impact is high, while integrity and availability are unaffected. No public exploit code or PoC is currently available, and the CVE has not been added to the CISA KEV catalog.

Technical Analysis

The vulnerability classifies under CWE-203: Observable Discrepancy, indicating that the issue arises from inconsistent behavior in how the browser processes or presents specific HTML constructs. In the context of a browser rendering engine, an observable discrepancy typically means that certain operations produce different cryptographic outcomes, timing responses, or rendering states depending on the presence of sensitive data. This behavioral difference becomes an oracle that an attacker can query through the DOM, JavaScript execution, or rendering side channels.

Because the NVD description lacks specific technical identifiers — no function names, API endpoints, or code paths are provided — we must reason about the mechanism at the class level. The most plausible interpretations of an "observable discrepancy" in HTML processing are:

1. Cross-Origin Information Leakage: The browser may incorrectly permit a cross-origin page to observe the state (e.g., size, timing, or loading behavior) of embedded resources from another origin. This violates the Same-Origin Policy (SOP).
2. HTML Parsing Differential: A parser discrepancy between the main rendering engine and a subcomponent (e.g., SVG, MathML, or shadow DOM) could leak whether specific markup was recognized, revealing the presence of sensitive DOM elements or attributes.
3. Timer-Based Side Channel: Timing differences in the execution of JavaScript or layout/reflow operations when sensitive content is present, enabling an attacker to infer information from a victim's browsing context.

The attack surface is the Chrome HTML rendering pipeline — specifically the parser, DOM implementation, and layout engine. The requirement for a "crafted HTML page" confirms that the malicious input is delivered entirely through web content, requiring no browser extensions or native binaries.

The high attack complexity in the CVSS vector suggests that exploitation is not straightforward. The attacker may need precise control over network conditions, browser state (e.g., cache contents), or multiple steps within a single page to successfully observe and interpret the discrepancy.

No specific patch commit hash is available beyond the fixed version (152.0.7977.65). Patch confidence is rated at 2/4 — a single source (NVD) claims a fix, but the vendor advisory has not been independently reviewed.

Exploitation Scenarios

Since no public PoC or exploit code exists, the following attack chain is inferred from the vulnerability class (CWE-203) and the attack vector defined by the CVSS vector (Network, User Interaction, High Complexity).

Step 1 — Reconnaissance/Target Identification: The attacker needs a target victim who uses Google Chrome version < 152.0.7977.65 and has access to sensitive information in their browser context (e.g., authenticated sessions to web applications, internal dashboards, or webmail). The attacker may harvest email addresses, social media profiles, or known corporate domains to identify potential victims. No specific network-level reconnaissance is required.

Step 2 — Triggering the Flaw Class: The attacker crafts an HTML page containing specific markup designed to trigger the observable discrepancy. The page is hosted on a domain the attacker controls. The victim must be enticed to click a link (phishing email, watering-hole injection, or social engineering) to load this page in their Chrome browser. The high attack complexity suggests the page may need to be visited multiple times, or the discrepancy may only manifest under specific conditions (e.g., cold cache, presence of HSTS headers, or a particular set of installed extensions).

Step 3 — Payload Execution (Vulnerability-Class Level): Once the page loads, JavaScript or HTML constructs are used to measure the discrepancy. For example:

• If the flaw is a cross-origin side channel: the page loads resources from a known target origin and measures timing or loading success/failure to infer whether the user is authenticated or the state of those resources.
• If the flaw is a parser differential: the page includes markup that is conditionally interpreted, and the rendering result (visible or invisible) reveals whether a pre-condition was met.

The page then transmits the observed data back to the attacker's server via network requests (e.g., fetch() or XMLHttpRequest). The exfiltrated data is limited to what can be inferred through the observable discrepancy — likely not full page content, but rather binary state information (e.g., "user is logged in to X" or "resource Y exists").

Step 4 — Post-Exploitation Impact: The information leakage (confidentiality impact high) can be used to:

• Verify authenticated sessions for targeted account takeover.
• Map internal network topology by probing for known resource paths.
• Enumerate user identity attributes from browser state.

Since the CIA triad is limited to confidentiality only, this is not a code-execution vulnerability. The attack does not persist — each session requires a fresh compromise of the user's interaction.

Impact Assessment

Business Impact: Direct, albeit limited, confidentiality breach. An attacker can obtain sensitive information from victims' browsing contexts without requiring prior access or privileges. For enterprise environments, this could expose SSO session states, internal application availability (useful for network reconnaissance), or the presence of confidential documents referenced in browser autofill/history.

Affected Systems: All Windows, macOS, Linux, and Android deployments of Google Chrome prior to version 152.0.7977.65. Chromium-based browsers that have not pulled the updated Chromium source are also potentially exposed, though the NVD scope identifies only Google Chrome.

Blast Radius: The attack requires active user interaction, which limits the blast radius to individual users successfully phished. The high attack complexity further reduces the likelihood of mass exploitation. The CVSS base score of 5.3 (Medium) reflects the difficulty of attack balanced against the high confidentiality impact.

CIA Impact: Confidentiality: High (C:H); Integrity: None (I:N); Availability: None (A:N). The vector string shows no privilege escalation or remote code execution — this is a pure information-disclosure scenario.

Detection Guidance

The following detection artifacts are generically applicable to client-side information-disclosure attempts in Chrome. Since no specific PoC exists, they focus on the behavioral patterns an attacker would exhibit (phishing pages, cross-origin probing, data exfiltration).

Sigma Rule

title: Chrome HTML Observable Discrepancy - Potentially Malicious Page
id: 8d1352a9-8a3e-4b5d-9c2f-1f1d7e0e2b10
status: experimental
description: Detects Chrome navigating to HTML pages that attempt to exploit CVE-2026-79242 by measuring cross-origin behavior or timing discrepancies
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\chrome.exe'
        CommandLine|contains: '--renderer'
    filter:
        CommandLine|contains:
            - '--extension-process'
            - '--utility-sub-type'
    condition: selection and not filter
level: medium
falsepositives:
    - Legitimate web applications that use timing-based performance measurement
    - Chrome extensions that perform fetch requests for non-malicious reasons
tags:
    - attack.t1204
    - attack.t1608
    - cve.2026.79242

YARA Rule

rule CVE_2026_79242_HTML_Discrepancy_Probe {
    meta:
        author = "ValtersIt Threat Intel"
        date = "2026-02-10"
        description = "Detects JavaScript patterns attempting to probe cross-origin timing or observable discrepancies in HTML rendering"
        reference = "CVE-2026-79242"
    strings:
        $a = { 74 69 6D 65 72 20 3D }          // "timer ="
        $b = { 70 65 72 66 6F 72 6D 61 6E 63 65 } // "performance"
        $c = { 6F 6E 6C 6F 61 64 20 3D }      // "onload ="
        $d = { 6D 65 74 61 20 68 74 74 70 2D 65 71 75 69 76 } // "meta http-equiv"
        $e = { 69 66 72 61 6D 65 20 73 72 63 }  // "iframe src"
        $f = { 78 6D 6C 48 74 74 70 52 65 71 75 65 73 74 } // "XMLHttpRequest"
    condition:
        3 of them and filesize < 500KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS Possible Chrome CVE-2026-79242 Cross-Origin Timing Probe"; flow:established,to_server; content:"GET"; http_method; content:"?"; http_uri; content:"performance"; nocase; http_uri; content:"timer"; nocase; http_uri; content:"origin"; nocase; http_uri; classtype:attempted-information-leak; sid:20267924201; rev:1; metadata:created_at 2026_02_10, cve CVE-2026-79242;)

Elastic Detection

// Detect Chrome processes accessing pages that combine cross-origin fetches with performance/timing analysis
sequence by process.pid
  [process where process.name == "chrome.exe" and process.args : "--renderer*"]
  [network where process.name == "chrome.exe" and network.direction : "outbound" and
     dns.question.name != null and dns.question.name : "*.attacker.com" and
     not cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")]
  [file where process.name == "chrome.exe" and file.name : "*.html*"]

Splunk SPL Query

index=browser sourcetype=chrome:console earliest=-1h
| where match(message, "(?i)(performance\.now|XMLHttpRequest|fetch\(|onload)")
| stats count by host, user, src_ip, dest_ip, message
| where count > 20
| eval match_status = if(match(message, "(?i)(origin|timer|timing|dedupe)"), "suspect", "review")
| where match_status = "suspect"
| table _time, host, user, src_ip, dest_ip, count, message

Wazuh OSSEC Rule

<group name="local,chrome,">
    <rule id="792420" level="8">
        <decoded>chrome</decoded>
        <match>Security: CVE-2026-79242</match>
        <description>Chrome rendered a page with observable HTML discrepancy characteristics for CVE-2026-79242</description>
        <group>attack.t1204,</group>
        <mitre>
            <id>T1204</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment: 2/4 — CLAIMED. A single source (NVD) indicates that Chrome 152.0.7977.65 resolves the issue. The vendor advisory has not been independently replicated, and the patch details (commit hash, release notes) are not available. However, this aligns with Chrome's aggressive patching cycle.

1. Immediate Mitigations (if patching is not immediate):

• Enforce the use of Chrome 152.0.7977.65 or later via enterprise policies (Windows GPO or macOS configuration profile) as soon as rollouts are staged.
• For high-risk users (finance, procurement, admin), restrict browsing to approved sites until the patch is applied.
• Use Chrome's --disable-features flag to disable relevant rendering features if a specific technical root cause were identified (not currently possible given sparse details).
• Monitor for phishing emails that direct users to external HTML pages; train users to avoid unknown links.

2. Patch/Upgrade Steps:

• Windows: Deploy via Google Update — configure Update policy override to allow automatic updates. For managed fleets, test in a pilot ring, then push via Group Policy.
• macOS: Update through the Chrome Updater or Jamf/Workspace ONE self-service catalog.
• Linux: Use the Google Chrome APT/YUM repository; run apt update && apt upgrade google-chrome-stable or equivalent.
• Android: Automatic updates are enabled by default via Google Play; verify in Managed Play Console.
• WebView/Embedded: If you distribute a Chromium-based browser (e.g., Electron), rebuild against Chromium >= 152.0.7977.65.

3. Long-Term Hardening:

• Subscribe to Google's Chromium security feed and the Chrome Releases blog for early vendor advisories.
• Implement browser patch-scanning in your vulnerability management tooling (e.g., Qualys, Tenable) to detect outdated versions.
• Benchmark Chrome security settings against CIS Benchmarks: enable SafeBrowsing, strict Site Isolation, and Block third-party cookies.
• Segment web-facing hosts from sensitive data stores to reduce the impact of any future client-side information leaks.
• Maintain a user-awareness program focused on click-hygiene, given the required user interaction.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-79242
2. Google Chrome Releases Blog: https://chromereleases.googleblog.com/
3. Chromium Bug Tracker: https://crbug.com/ (search for "79242" or version 152.0.7977.65)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — (CVE-2026-79242 is NOT listed; no exploit-in-the-wild evidence as of this report)
5. MITRE ATT&CK - T1204 User Execution: https://attack.mitre.org/techniques/T1204/ (and T1608 Stage Capabilities: https://attack.mitre.org/techniques/T1608/)

Note on Threat Actor Activity: As of the writing of this report, no known threat actor campaigns have been publicly attributed to CVE-2026-79242. The EPSS score of 0.00258 indicates a low probability of active exploitation in the wild (17.2 percentile of exploited CVEs). Chained exploitation with other vulnerabilities has not been documented.