Description
Information leak in Geolocation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-08-25
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Apply Update
AI Analysis

Impact

A crafted HTML page can trigger a geolocation request in Google Chrome versions earlier than 152.0.7977.65, causing the browser to expose sensitive location data to the page. The vulnerability permits a remote attacker, using social engineering techniques, to retrieve confidential user information. The primary weaknesses are information disclosure (CWE‑200) and an input validation issue (CWE‑201).

Affected Systems

Any installation of Google Chrome before version 152.0.7977.65 is vulnerable. The issue applies across the stable channel and older releases that have not received the patch issued on August 2026.

Risk and Exploitability

The exploit requires a user to visit a malicious page and conflate a social‑engineering prompt, so it is a remote but user‑interaction dependent attack. EPSS score is < 1% and the Chromium reported severity is medium and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 6.5, indicating medium severity. Consequently, the risk remains moderate, yet the potential for data leakage warrants immediate attention.

Generated by OpenCVE AI on September 12, 2026 at 01:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 152.0.7977.65 or later via the official update channel
  • Disable geolocation permissions for all sites or restrict them to trusted domains through Chrome settings or enterprise policy
  • Educate users about phishing and the risks of granting location access to untrusted web pages

Generated by OpenCVE AI on September 12, 2026 at 01:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Information leak in Geolocation
Weaknesses CWE-201
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 31 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 26 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Chromium Geolocation Information Leak Vulnerability

Wed, 26 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Chromium Geolocation Information Leak Vulnerability

Tue, 25 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Information leak in Geolocation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-200
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-26T18:38:09.819Z

Reserved: 2026-08-25T06:08:39.002Z

Link: CVE-2026-79075

cve-icon Vulnrichment

Updated: 2026-08-26T18:18:18.717Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:18:03.280

Modified: 2026-08-31T13:38:48.740

Link: CVE-2026-79075

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-25T20:10:44Z

Links: CVE-2026-79075 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-12T02:00:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-201

    Insertion of Sensitive Information Into Sent Data