Description
Race condition in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-08-25
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure via Remote Attack
Action: Immediate Patch
AI Analysis

Impact

A race condition exists in Google Chrome's editing feature, enabling a remote attacker who succeeds in social engineering a user to load a specially crafted HTML page. The flaw can lead to disclosure of sensitive data that the user has recently edited, without any exploitation of code execution or denial of service. The weakness is identified as a race condition (CWE-367).

Affected Systems

Affected systems are Google Chrome browsers on all platforms running a build prior to version 152.0.7977.65. The specific crash involves the editing component invoked when a page is loaded, regardless of operating system. Users on earlier releases should be aware that any recent edits may be exposed through this flaw.

Risk and Exploitability

The CVSS score is 5.3, which is low and aligns with Chromium's low severity classification. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The attack vector requires the victim to open a malicious HTML page, which can be delivered through phishing or compromised websites. While the likelihood of exploitation is not quantified, social engineering remains the practical prerequisite; patches address the race condition directly.

Generated by OpenCVE AI on August 26, 2026 at 21:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome to version 152.0.7977.65 or later
  • Avoid opening untrusted HTML content until the browser is updated
  • Disable or restrict the editing functionality in Chrome if the feature is not needed

Generated by OpenCVE AI on August 26, 2026 at 21:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Wed, 26 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome Editing Leads to Remote Information Leakage

Wed, 26 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 26 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Wed, 26 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 26 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Title Race Condition in Chrome Editing Leads to Remote Information Leakage

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Race condition in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-367
References

cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-26T18:37:07.401Z

Reserved: 2026-08-25T06:11:15.457Z

Link: CVE-2026-79196

cve-icon Vulnrichment

Updated: 2026-08-26T18:19:23.867Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:18:13.360

Modified: 2026-08-26T20:18:05.663

Link: CVE-2026-79196

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T22:00:04Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition