Security readout for executives and security teams
Plain-English summary
A malicious Chrome extension could potentially expose memory inside Chrome’s sandbox after convincing a user to install or use it. Google describes the issue as low severity and identifies Chrome 152.0.7977.65 as the fixed boundary. The bundle’s critical CVSS rating conflicts with that assessment and the stated social-engineering requirement.
Executive priority
Complete a prompt enterprise browser update, with elevated priority for unmanaged or extension-heavy environments. Current sources do not justify an emergency incident declaration solely from this CVE. Track update coverage and investigate unexpected extensions, while recognizing that the supplied critical score conflicts with Google’s low-severity assessment.
Technical view
CVE-2026-79148 is a CWE-193 off-by-one error in Chrome DevTools. The description says versions before 152.0.7977.65 may permit sandboxed memory disclosure through a crafted extension. The supplied CVSS vector claims no user interaction and high integrity impact, but those claims are not supported by the narrative description.
Likely exposure
Exposure is most plausible on Chrome versions earlier than 152.0.7977.65 where users can install crafted or untrusted extensions. Environments enforcing current browser versions and tightly controlling extensions should have lower exposure. The bundle inconsistently lists 152.0.7977.65 as affected while describing it as the fixed boundary.
Exploitation context
No active exploitation is established: the bundle says this CVE is not in KEV and provides no exploitation evidence. Successful abuse reportedly requires social engineering involving a crafted Chrome extension. The documented outcome is potential memory reading inside the sandbox, not confirmed sandbox escape or host compromise.
Researcher notes
The key evidentiary limitation is inconsistent metadata: the narrative requires social engineering and describes memory disclosure, while CVSS states UI:N and high integrity impact. The affected-version entry also names 152.0.7977.65 despite the description saying versions prior to it are vulnerable. Treat the narrative and Google release boundary as more specific, pending clarification.
Mitigation direction
- Update Google Chrome to version 152.0.7977.65 or later through vendor-supported channels.
- Prioritize endpoints where users can install extensions from untrusted sources.
- Restrict unapproved Chrome extensions until update coverage is confirmed.
- Check Google and Chromium guidance for any revised remediation details.
Validation and detection
- Inventory Chrome versions and identify endpoints earlier than 152.0.7977.65.
- Confirm updated endpoints report version 152.0.7977.65 or later.
- Review installed extensions for unexpected or unapproved entries.
- Monitor vendor advisories and KEV status for exploitation updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-193: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-79148 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.htmlCVE reference, Chrome
- https://issues.chromium.org/issues/532303080CVE reference, Chrome
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Off-by-one Error
Off-by-one Error represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.