CVE-2026-78959: Google Chrome FileSystem Auth Bypass Flaw

CVE-2026-78959 Overview

CVE-2026-78959 is a security vulnerability in the FileSystem component of Google Chrome versions prior to 152.0.7977.65. The flaw stems from improper handling of case sensitivity [CWE-178] when Chrome processes file system paths. A remote attacker can craft a malicious HTML page that, combined with social engineering, bypasses system access restrictions inside the browser sandbox. Google has classified the Chromium security severity as Medium. The vulnerability affects Chrome across all desktop platforms where case sensitivity semantics differ between the operating system and Chrome's internal path normalization logic.

Critical Impact
A remote attacker who convinces a user to visit a crafted web page can bypass Chrome's FileSystem access restrictions, potentially exposing files that should remain outside the site's permitted scope.

Affected Products

Google Chrome for Windows prior to 152.0.7977.65
Google Chrome for macOS prior to 152.0.7977.65
Google Chrome for Linux prior to 152.0.7977.65

Discovery Timeline

2026-08-25 - CVE-2026-78959 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78959

Vulnerability Analysis

The vulnerability resides in Chrome's FileSystem implementation, which mediates web content access to sandboxed and user-selected file resources. Chrome normalizes file paths before enforcing access checks. When the normalization logic treats path components with inconsistent case sensitivity, an attacker can construct paths that pass access checks but resolve, at the operating system layer, to a different resource than the one authorized. This is a classic Improper Handling of Case Sensitivity weakness tracked under CWE-178.

Root Cause

The root cause is a mismatch between how Chrome compares FileSystem paths internally and how the underlying operating system resolves them. On case-insensitive file systems such as NTFS and default APFS, two path strings that differ only in letter case refer to the same file, while Chrome's access checks may treat them as distinct. This inconsistency allows a page to reference an authorized path variant while the OS delivers a resource the site should not reach.

Attack Vector

Exploitation requires user interaction. An attacker hosts a crafted HTML page and uses social engineering to convince the user to visit it and interact with FileSystem prompts or drag-and-drop functionality. Once triggered, the page issues FileSystem API calls with case-manipulated paths to bypass origin or directory scope restrictions. See the Chromium Issue #518084889 and the Chrome Stable Release Update for vendor context.

No verified proof-of-concept code has been published. The vulnerability manifests in the FileSystem path comparison and canonicalization logic; refer to the Chromium issue tracker for technical implementation details once access is granted by Google.

Detection Methods for CVE-2026-78959

Indicators of Compromise

Chrome browser processes on endpoints reporting version strings earlier than 152.0.7977.65 after the patch release date.
Unexpected FileSystem API activity from renderer processes, particularly repeated access attempts to paths that differ only in letter case.
Browser telemetry showing user-granted FileSystem permissions immediately followed by traversal to sibling or parent directories.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any instance below 152.0.7977.65.
Monitor web proxy and DNS logs for user visits to newly registered or low-reputation domains that host FileSystem API interactions.
Correlate browser child-process file access events with the origin URL that initiated the FileSystem grant to spot scope violations.

Monitoring Recommendations

Enable enterprise browser reporting through Chrome Browser Cloud Management to receive version and extension telemetry.
Alert on any Chrome renderer process reading files outside directories the user explicitly selected within the current session.
Track social engineering indicators such as phishing pages that instruct users to click FileSystem access prompts.

How to Mitigate CVE-2026-78959

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Verify that Chrome auto-update is enabled and functioning; force an update check on managed fleets.
Communicate to users that they should not accept FileSystem access prompts from unfamiliar websites.

Patch Information

Google released the fix in the Chrome Stable channel at version 152.0.7977.65. Details are available in the Chrome Stable Release Update. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi typically ship the same fix in downstream releases; administrators should confirm the merged commit landed in their vendor's build.

Workarounds

Restrict FileSystem API usage through enterprise policy by configuring DefaultFileSystemReadGuardSetting and DefaultFileSystemWriteGuardSetting to block by default.
Deploy site allowlists using FileSystemReadAskForUrls and FileSystemWriteAskForUrls so only trusted origins can prompt for FileSystem access.
Provide targeted user awareness training covering social engineering tactics that abuse browser file access prompts.

bash

# Chrome enterprise policy example (Linux JSON policy file)
# Place in /etc/opt/chrome/policies/managed/filesystem-restrict.json
{
  "DefaultFileSystemReadGuardSetting": 2,
  "DefaultFileSystemWriteGuardSetting": 2,
  "FileSystemReadAskForUrls": ["https://[*.]corp.example.com"],
  "FileSystemWriteAskForUrls": ["https://[*.]corp.example.com"]
}