CVE-2026-78898: Google Chrome Auth Bypass Vulnerability

CVE-2026-78898 Overview

CVE-2026-78898 is an incorrect authorization vulnerability [CWE-863] in the Downloads component of Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to bypass system access restrictions by delivering a crafted HTML page. Exploitation requires user interaction through social engineering, which reduces automated exploitability but keeps the flaw practical against targeted users. Google classified the Chromium security severity as Medium. The vulnerability affects Chrome installations across desktop platforms served by the Stable channel.

Critical Impact
A remote attacker who lures a user to a crafted page can bypass Chrome's Downloads authorization checks and cause the browser to fetch or place files outside intended access boundaries.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers inheriting the Downloads authorization logic from affected Chromium versions
Windows, macOS, and Linux Stable channel builds released before the fix

Discovery Timeline

2026-08-25 - CVE-2026-78898 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78898

Vulnerability Analysis

The flaw resides in Chrome's Downloads subsystem, where authorization checks fail to correctly validate whether an origin is permitted to trigger specific download actions. The condition maps to [CWE-863: Incorrect Authorization], meaning the code performs an authorization check but reaches the wrong decision. An attacker hosting a crafted HTML page can drive the browser into a state where a download proceeds despite policy or user-consent boundaries that should have blocked it. Because the flaw sits in the browser's own trust boundary rather than in a renderer sandbox escape, the effective impact depends on how the attacker chains the bypass with social engineering, such as convincing the user to open, run, or trust the resulting file.

Root Cause

The root cause is an authorization decision error inside the Downloads flow. Chrome enforces restrictions on when and how content may be written to disk or associated with system-level handlers. In the affected code path, the check either evaluates the wrong context or fails to account for a specific request shape produced by a crafted HTML document. This lets a page influence the download decision beyond its origin's normal privileges.

Attack Vector

Exploitation requires the victim to visit or interact with attacker-controlled content. The attacker hosts a crafted HTML page and uses social engineering to guide the user through the interaction that triggers the flawed authorization path. No memory corruption primitive is required. See the Chromium Issue Tracker entry and the Google Chrome Stable Update announcement for vendor details.

Detection Methods for CVE-2026-78898

Indicators of Compromise

Chrome browser processes writing files to unexpected paths shortly after navigation to an unfamiliar external domain
Downloaded files with mismatched MIME types, unusual extensions, or handler associations that bypass SmartScreen or Safe Browsing prompts
Outbound HTTP(S) requests from Chrome to newly registered or low-reputation domains immediately preceding suspicious file creation events

Detection Strategies

Correlate browser process file-write telemetry with the originating tab URL to identify downloads that skipped user prompts
Alert on Chrome versions below 152.0.7977.65 reported by endpoint inventory or user-agent logs at web proxies
Hunt for HTML pages served with scripted download triggers referencing atypical URL schemes or handler intents

Monitoring Recommendations

Track Chrome version drift across managed endpoints and flag hosts that remain on pre-152.0.7977.65 builds
Monitor Downloads directory activity for executable, script, or installer files created without an interactive save dialog event
Log and review Safe Browsing bypass events and download warning dismissals for post-incident triage

How to Mitigate CVE-2026-78898

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force-restart Chrome after policy-driven updates so the patched binary is actually loaded into memory
Audit Chromium-based browsers in the environment and apply upstream fixes as vendors publish rebased builds

Patch Information

Google addressed the vulnerability in the Stable channel release documented in the Google Chrome Stable Update announcement. The fix ships in Chrome 152.0.7977.65 and later. Technical details are tracked in Chromium Issue #499423269.

Workarounds

Enforce enterprise download restrictions using the DownloadRestrictions policy to block dangerous file types until patching completes
Restrict script-initiated downloads and require user gestures through browser policy where supported
Deliver targeted user awareness reminders about download prompts originating from unfamiliar sites

bash

# Example Chrome enterprise policy to constrain risky downloads (Linux managed policy path)
cat >/etc/opt/chrome/policies/managed/downloads.json <<'EOF'
{
  "DownloadRestrictions": 3,
  "URLBlocklist": ["*"],
  "URLAllowlist": ["https://*.corp.example.com"]
}
EOF