Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-79285: Chrome on Windows may leak cross‑origin data
CVE-2026-79285 · published 2 months ago
Summary
Google Chrome (and Debian Chromium) on Windows versions before 152.0.7977.65 can expose data from other sites when a malicious web page is visited. The issue comes from an uninitialized graphics component that can be triggered by specially crafted HTML. Update Chrome or Chromium to version 152.0.7977.65 or newer to close the gap.
What to do
- Update google chrome to version 152.0.7977.65 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | chrome | < 152.0.7977.65 | |
| Debian:11 | debian | chromium | All versions |
| Debian:12 | debian | chromium | All versions |
| Debian:13 | debian | chromium | All versions |
| Debian:14 | debian | chromium | All versions |
Original advisory text
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Med...
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-908Use of Uninitialized Resource
Timeline
Published25 Aug 2026
Updated4 Nov 2026
First seen27 Aug 2026
Track software like this
Free during beta