Description
Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)
Published: 2026-08-25
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Update Browser
AI Analysis

Impact

Google Chrome versions prior to 152.0.7977.65 contain a missing authorization flaw in HTTP 2 that allows a remote attacker to construct custom network traffic and leak sensitive information. The vulnerability can lead to confidentiality exposure of data that passes through the browser. The weakness is a missing authorization control, identified as CWE‑862.

Affected Systems

The flaw affects Google Chrome for desktop. Any user running Chrome before version 152.0.7977.65 is potentially vulnerable, regardless of operating system.

Risk and Exploitability

The vulnerability is exploitable over the network with crafted HTTP 2 frames and requires no privileged local access. Because it can be triggered by any attacker who can observe or influence the Chrome traffic and the EPSS score is <1%, the exact likelihood remains low but measurable. The CVSS score of 5.9 indicates a medium severity impact, and the issue is not listed in the CISA KEV catalog. Attackers would need to supply malformed HTTP 2 traffic to the target system.

Generated by OpenCVE AI on August 26, 2026 at 22:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Chrome 152.0.7977.65 or newer.
  • If an update cannot be installed immediately, disable HTTP 2 via Chrome’s developer flags (chrome://flags/#enable-http2) to prevent the attacker from sending crafted frames.
  • Continuously monitor Google’s release notes and apply subsequent security updates as soon as they are available.

Generated by OpenCVE AI on August 26, 2026 at 22:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Thu, 27 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 26 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Title Missing Authorization in HTTP/2 Enables Remote Information Leak in Chrome

Wed, 26 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 26 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Title Missing Authorization in HTTP/2 Enables Remote Information Leak in Chrome

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)
Weaknesses CWE-862
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-26T18:42:45.561Z

Reserved: 2026-08-25T06:11:31.422Z

Link: CVE-2026-79208

cve-icon Vulnrichment

Updated: 2026-08-26T18:12:37.801Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:18:14.713

Modified: 2026-08-27T13:42:21.353

Link: CVE-2026-79208

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T22:15:05Z

Weaknesses