CVE-2026-78946: Google Chrome Auth Bypass Vulnerability

CVE-2026-78946 Overview

CVE-2026-78946 is an incorrect authorization vulnerability in the Select component of Google Chrome prior to version 152.0.7977.65. A remote attacker can bypass the web origin policy by serving a crafted HTML page to a targeted user. Chromium classifies the security severity as Low, and the flaw maps to CWE-863: Incorrect Authorization. Successful exploitation requires user interaction such as visiting an attacker-controlled page. The issue affects the browser's enforcement of same-origin restrictions around the HTML <select> element and its associated UI surface.

Critical Impact
Attackers who lure a user to a malicious page can bypass web origin policy in Chrome, undermining a core browser security boundary that isolates content across sites.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based builds packaging vulnerable Select code from the same release train
Downstream browsers that ship the affected Chromium Select component before the fix

Discovery Timeline

2026-08-25 - CVE-2026-78946 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78946

Vulnerability Analysis

The defect lives in Chrome's Select implementation, the code path that backs the HTML <select> form control and its popup UI. Under specific conditions, the component fails to correctly authorize an action against the active document's web origin. This lets content from one origin influence or observe behavior that should remain scoped to another origin. The result is a partial bypass of the browser's same-origin enforcement, the mechanism that isolates cross-site content.

Exploitation requires the victim to load a crafted HTML page and interact with browser content. The attack is remote and network-delivered, and no elevated privileges are needed on the target. Confidentiality impact is none per the assigned CVSS metrics, while integrity is affected at a limited level. Chromium's own severity rating for this defect is Low, consistent with the constrained impact of an origin-policy bypass gated by user interaction.

Root Cause

The root cause is an authorization check that does not correctly validate the requesting origin before permitting a Select-related operation. See Chromium Issue #517718241 for upstream triage details.

Attack Vector

Delivery is through a crafted HTML page hosted on an attacker-controlled site, an attacker-influenced third-party context (advertisement, embedded iframe), or a compromised web property. The victim must load the page and interact with it. No prior authentication to the target origin is required. Because no verified public proof of concept is available, defenders should treat exploitation details as constrained to the description in the vendor advisory.

Detection Methods for CVE-2026-78946

Indicators of Compromise

No public indicators of compromise are associated with CVE-2026-78946 at the time of publication.
Presence of Chrome builds below 152.0.7977.65 on managed endpoints is the most reliable exposure signal.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host running a build earlier than 152.0.7977.65.
Alert on user navigation events to newly registered or low-reputation domains that serve HTML content invoking <select> behaviors in unusual ways.
Correlate browser process telemetry with outbound web requests to identify attacker-controlled infrastructure hosting crafted pages.

Monitoring Recommendations

Ingest browser version telemetry into a central data lake and dashboard non-compliant endpoints daily.
Monitor enterprise browser management consoles or MDM feeds for update failures on Chrome installations.
Track user reports of unexpected form-control behavior on unfamiliar sites, which can indicate probing against origin-policy weaknesses.

How to Mitigate CVE-2026-78946

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on every managed endpoint. See the Google Chrome Stable Update advisory.
Force-restart Chrome after the update installs so the patched binary is loaded into memory.
Verify that automatic updates are enabled and not blocked by enterprise policy, group policy objects, or restrictive proxies.

Patch Information

Google addressed CVE-2026-78946 in the Chrome Stable channel release 152.0.7977.65. The fix is delivered through the standard Chrome auto-update mechanism. Administrators managing Chrome via enterprise policy should confirm that the TargetVersionPrefix or equivalent controls do not pin endpoints to a pre-patch version. Chromium-based downstream browsers should adopt the corresponding upstream commit referenced in Chromium Issue #517718241.

Workarounds

Restrict browsing to trusted sites through enterprise proxy allowlists until the update is deployed fleet-wide.
Educate users to avoid interacting with unsolicited pages, especially those requesting interaction with form controls or dropdown menus.
Enable site isolation and strict third-party cookie or storage partitioning to reduce cross-origin leverage available to a crafted page.

bash

# Configuration example: verify Chrome version on Windows, macOS, and Linux endpoints
# Windows (PowerShell)
(Get-Item "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Expected output: 152.0.7977.65 or higher