CVE-2026-79265: Incomplete cleanup in Google Chrome

This vulnerability involves incomplete cleanup in the GetUserMedia component of Google Chrome before version 152.0.7977.65. An attacker with control over the renderer process and leveraging social engineering techniques can craft an HTML page that leads to unauthorized disclosure of sensitive information. The CVSS 3.1 base score is 5.3, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the browser environment. There is no impact on integrity or availability. The attack requires prior compromise of the renderer process and user interaction, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance. Until a patch is confirmed, users should exercise caution with untrusted content and avoid social engineering traps that could lead to renderer process compromise.