Executive brief
Google Chrome is a widely-used web browser that includes built-in developer tools (DevTools) for web developers. An off-by-one error in DevTools could allow an attacker to read memory inside the browser sandbox via a malicious Chrome extension, potentially exposing sensitive data. Exploitation requires social engineering to trick a user into installing a crafted extension.
Technical details
An off-by-one error exists in the DevTools component of Google Chrome versions prior to 152.0.7977.65. The vulnerability allows a remote attacker to read memory inside the sandbox by leveraging a crafted Chrome extension, contingent on social engineering to convince a user to install the malicious extension. The attack vector is network-based through extension distribution and requires user interaction. The fix is available in Chrome 152.0.7977.65 and later. Chromium assigned a Low security severity rating despite the reported CVSS score, likely due to the requirement for user interaction and the sandboxed scope of exposure.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed: CVE-2026-79148 disclosed in Chrome 152 stable release
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65