CVE-2026-78954: Google Chrome Extensions Auth Bypass Flaw

CVE-2026-78954 Overview

CVE-2026-78954 is an incorrect authorization vulnerability [CWE-863] in the Extensions component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass the web origin policy using a crafted HTML page. Google's Chromium team has rated the security severity as High. The issue is tracked in Chromium Issue Tracker #540870921 and was addressed in the Stable Channel update for Desktop.

Critical Impact
Attackers with an already-compromised renderer can bypass same-origin protections in the Extensions subsystem, enabling cross-origin data access and expanding the blast radius of an initial browser compromise.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the affected Extensions component
All supported desktop platforms (Windows, macOS, Linux) shipping the vulnerable build

Discovery Timeline

2026-08-25 - CVE-2026-78954 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78954

Vulnerability Analysis

The vulnerability resides in Chrome's Extensions subsystem, which enforces authorization checks that gate cross-origin operations. Incorrect authorization logic allows a compromised renderer process to reach functionality that should be restricted by the web origin policy. Because extensions operate with elevated privileges compared to standard web content, a bypass here lets attacker-controlled code in the renderer perform actions across origins that the same-origin policy would normally block.

Exploitation is not a standalone drive-by scenario. The attacker must first achieve renderer process compromise, typically through a separate memory corruption or type confusion flaw. Once inside the renderer sandbox, the crafted HTML page interacts with the Extensions component to trigger the authorization gap. See the Chromium Issue Tracker #540870921 for engineering details.

Root Cause

The root cause is an authorization check that does not correctly validate the origin or privilege context of a caller in the Extensions component. The CWE-863: Incorrect Authorization classification indicates that access decisions are made using incomplete or incorrect logic, permitting operations that should be denied based on the requester's web origin.

Attack Vector

The attack requires two stages. First, the attacker compromises the renderer process, usually by chaining a separate Chrome vulnerability. Second, attacker-controlled code loads a crafted HTML page that invokes the vulnerable Extensions pathway to bypass origin enforcement. Successful exploitation permits reading or manipulating resources bound to other web origins, which can lead to credential theft, session hijacking, or further sandbox escape when combined with additional flaws.

// No verified proof-of-concept code is publicly available.
// Refer to the Chromium Issue Tracker for technical details:
// https://issues.chromium.org/issues/540870921

Detection Methods for CVE-2026-78954

Indicators of Compromise

Chrome browser processes reporting a version string below 152.0.7977.65 in enterprise inventory data
Unexpected extension activity accessing resources tied to unrelated web origins
Renderer process crashes or anomalous child process spawning preceding cross-origin data access
Outbound requests from browser telemetry containing data from origins the user did not visit

Detection Strategies

Inventory installed Chrome versions across the fleet and flag hosts running builds prior to 152.0.7977.65
Correlate browser telemetry with endpoint process telemetry to identify renderer compromise indicators that precede extension misuse
Alert on unsigned or newly installed extensions performing cross-origin network calls
Monitor for known exploit chains that pair a renderer RCE with post-compromise privilege abuse

Monitoring Recommendations

Ingest browser version data and extension inventories into your SIEM for continuous version-drift monitoring
Track Chrome auto-update health signals and alert when updates stall on managed endpoints
Watch for anomalous DOM or extension API activity in browser isolation or EDR telemetry
Review the Chrome Releases Stable Channel Update for related fixes bundled in the same release

How to Mitigate CVE-2026-78954

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed desktops
Force restart of Chrome sessions to ensure the patched binary is loaded into memory
Audit installed extensions and remove unnecessary or unverified add-ons that widen the attack surface
Confirm enterprise policy enforces automatic Chrome updates and blocks version downgrades

Patch Information

Google addressed CVE-2026-78954 in the Chrome Stable Channel Desktop release 152.0.7977.65. Details are documented in the Google Chrome Releases announcement. Chromium-based browsers should incorporate the corresponding upstream fix; verify with each vendor's release notes before assuming coverage.

Workarounds

No official workaround is published; patching is the supported remediation path
Restrict extension installation to an allowlist managed via ExtensionInstallAllowlist and ExtensionInstallBlocklist policies
Enable Site Isolation and Enhanced Safe Browsing to raise the cost of chained renderer exploitation
Deploy browser isolation for high-risk user groups until patch deployment is confirmed enterprise-wide

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enterprise policy example (Chrome policy JSON) to enforce updates
# See: https://chromeenterprise.google/policies/
{
  "TargetVersionPrefix": "152.",
  "UpdateDefault": 1,
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": ["<approved-extension-ids>"]
}