Information leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML… (CVE-2026-79252)

CVE-2026-79252 is an information leak vulnerability in the ServiceWorker implementation of Google Chrome before version 152.0.7977.65. It permits a remote attacker to extract cross-origin data by leveraging a specially crafted HTML page. The vulnerability has a CVSS v3.1 base score of 4.3 (medium severity) with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts confidentiality only. There is no indication of integrity or availability impact. No known exploits in the wild have been reported. No patch or remediation details are provided in the source data.

An attacker can obtain sensitive cross-origin data from a victim's browser by convincing them to load a malicious HTML page, potentially leading to unauthorized disclosure of information. The impact is limited to confidentiality loss without affecting integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor official Google Chrome security advisories for updates and apply the official fix once available. Until then, exercising caution with untrusted web content is advisable.