Chromium CVE-2026-79293: Animation Bug Leaks Data in Chrome, Edge

CVE-2026-79293 is an information-leak vulnerability in the Animation component of Chromium, the open-source engine behind Google Chrome, Microsoft Edge, and several other browsers. Microsoft's Security Update Guide entry, published 2026-08-28, assigns the CVE to Chrome and notes that Edge inherits the flaw because it ingests Chromium code upstream.

MSRC's own listing is short on technical detail: it names the vulnerability type as a security vulnerability affecting the Microsoft Edge (Chromium-based) product family, points to Google Chrome Releases for further information, and advises applying the latest security updates. No CVSS score, attack vector description, or exploitation status appears in the MSRC record itself, which is typical for Microsoft's Chromium-ingestion advisories that defer technical specifics to Google's own release notes.

Browser animation code handles CSS transitions, the Web Animations API, and related rendering paths that run constantly as pages load and update. Because this code executes on nearly every website a user visits, a flaw here has a wide practical reach compared with bugs buried in rarely used features.

Information-leak bugs rarely grant an attacker full control on their own. Instead, they typically expose fragments of memory or cross-origin state that can help an attacker profile a target or defeat exploit mitigations, then get chained with a second, more damaging bug. That is why Chromium and Microsoft both treat leak-class issues as worth patching promptly even when they carry moderate severity.

MSRC's advisory names Microsoft Edge (Chromium-based) as the affected product family. Because the underlying fix comes from the Chromium project, any browser built on the same engine, including Google Chrome and other Chromium-derived browsers, is a candidate for exposure until each vendor ships its own corresponding update.

• Enterprise fleets running Microsoft Edge on managed update rings.
• Individual users on unmanaged Chrome or Edge installs that have not restarted the browser recently.
• Organizations that embed a Chromium runtime inside packaged applications, which may lag behind standalone browser update cadence.

The MSRC record for CVE-2026-79293 states the vulnerability was released 2026-08-28, classifies it as a Security Vulnerability, and lists Microsoft Edge (Chromium-based) as the product family. It explicitly directs readers to Google Chrome Releases for the underlying technical write-up, since Chrome's security team, not Microsoft, is the CVE-assigning authority for this issue.

No CVSS vector, CWE identifier, EPSS score, or proof-of-concept status is present in the source reviewed for this CVE, so those fields are left unspecified rather than estimated. Readers should treat the MSRC page as a tracking pointer for Edge rather than a full technical disclosure.

MSRC's remediation guidance for CVE-2026-79293 is to apply the latest security updates from Microsoft for the affected products, which in practice means updating Microsoft Edge to its current stable build. Because the fix originates in Chromium, Google Chrome users should likewise confirm they are on the latest Chrome release channel build.

• Check Edge's version under Settings > About Microsoft Edge and force an update check if the browser has not restarted recently.
• Check Chrome's version under chrome://settings/help and restart the browser to apply any pending update.
• On managed fleets, verify update policy rings and confirm the deployed build number rather than assuming the device is current.
• Track Chromium-derived browsers or embedded runtimes separately, since they may not follow Chrome or Edge's release schedule.

Because MSRC's entry defers technical detail to Google's Chrome Releases page, admins tracking this CVE should watch for Google's own advisory to confirm the patched Chrome version number and any additional context on exploitability. Microsoft typically updates its Security Update Guide entry once the corresponding Edge build ships.

Fleet-wide inventory remains the practical bottleneck: a device can show Windows fully patched while its browser binary is stale, particularly on VDI images or persistent user profiles. Confirming actual installed Edge and Chrome build numbers, rather than trusting patch-compliance dashboards alone, is the most reliable way to know whether CVE-2026-79293 is closed on a given machine.

CVE-2026-79293 is a Chromium Animation information-leak flaw listed by MSRC on 2026-08-28, with no CVSS score or exploitation status published for this specific entry.

Security: Information-disclosure bugs of this type are typically used as reconnaissance building blocks that can be chained with a separate memory-corruption flaw for a fuller compromise.

Privacy: If exploited, this class of bug can expose fragments of cross-context browsing data rather than full account takeover on its own.

MSRC published CVE-2026-79293, an information-leak flaw in Chromium's Animation component, on 2026-08-28, listing Microsoft Edge (Chromium-based) as the affected product with the fix originating in upstream Chromium.