CVE-2026-79031

View on CVE.org
Published Aug 25, 2026 CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Description
Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

A crafted HTML page can trigger an improper resource exposure in the Preload feature of Google Chrome prior to version 152.0.7977.65, allowing a remote attacker to bypass Chrome’s site isolation. The result is that an attacker could access or inject content into a different site’s isolated context, potentially exposing sensitive data or injecting malicious code. The weakness is identified as CWE‑668: Improper Resource Exposure.

Affected Systems

All users running Google Chrome versions earlier than 152.0.7977.65 are affected. The vulnerability is limited to desktop Chrome installations that support the Preload feature.

Risk and Exploitability

The CVE has a CVSS score of 3.1 (Medium). The EPSS score is below 1%, indicating a low exploitation probability, and it is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, relying on a malicious HTML page that a user must visit. Bypassing site isolation could allow attackers to read or manipulate content across site boundaries, posing a significant confidentiality and integrity risk.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Chrome update that includes version 152.0.7977.65 or later, which removes the improper resource exposure in Preload.
  • Disable the Preload feature through Chrome flags or enterprise policy until an official update is applied.
  • Enforce site isolation via Chrome policy or flags to prevent isolated domains from accessing each other through preloaded resources.

Generated by OpenCVE AI on August 28, 2026 at 18:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Remote bypass of Chrome site isolation via improper resource exposure in Preload
Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N'}
Type Values Removed Values Added
Title Remote bypass of Chrome site isolation via improper resource exposure in Preload
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-668
References
Earlier changes (1)
Weaknesses
  • CWE-668

    Exposure of Resource to Wrong Sphere

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Sep 17, 2026, 6:52 PM
Reserved
Aug 25, 2026, 6:08 AM

View source JSON

Updated
Aug 27, 2026, 7:08 PM

JSON

Status
Analyzed
Published
Aug 25, 2026, 9:17 PM
Modified
Aug 28, 2026, 2:38 PM

View source JSON

No data.

Updated
Aug 28, 2026, 7:00 PM

JSON