CVE-2026-78966: Google Chrome QUIC Auth Bypass Vulnerability

CVE-2026-78966 Overview

CVE-2026-78966 is an externally controlled reference vulnerability [CWE-610] in the QUIC (Quick UDP Internet Connections) implementation in Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to bypass the web origin policy through a crafted HTML page. Google classifies the Chromium security severity as Medium. The flaw undermines the same-origin protections that isolate content between web origins, enabling cross-origin data access from an attacker-controlled page.

Critical Impact
A remote attacker can bypass the web origin policy in Chrome by luring a user to a crafted HTML page, exposing cross-origin resources over QUIC.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers sharing the affected QUIC stack
Embedded applications bundling vulnerable Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-78966 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD

Technical Details for CVE-2026-78966

Vulnerability Analysis

The vulnerability resides in Chrome's QUIC transport implementation. QUIC is a UDP-based multiplexed transport that carries HTTP/3 traffic. Chrome's QUIC code path exposes an externally controlled reference [CWE-610]. An attacker-supplied value influences a resource reference that the browser resolves without correctly enforcing origin boundaries.

Because the reference is controlled by remote input, an attacker can steer the browser to treat content or connections as belonging to a different web origin than intended. This breaks the invariant enforced by the same-origin policy, which restricts scripts and documents from one origin from reading data from another origin. The result is a web origin policy bypass rather than memory corruption or direct code execution.

The issue was addressed in Chrome Stable 152.0.7977.65. Details of the fix are tracked in the Chromium Issue Tracker #497637694.

Root Cause

The root cause is improper validation of a reference value derived from remote QUIC input. The QUIC layer accepts or propagates identifiers used to associate connections or resources with an origin. When these identifiers are attacker-controlled and not fully constrained, downstream code resolves them into origin-scoped operations. This mismatch enables cross-origin access that the browser's security model would otherwise prevent.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page that initiates QUIC connections structured to trigger the flawed reference handling. When a victim visits the page in a vulnerable Chrome build, the browser resolves the manipulated reference and permits access to content associated with a different origin. No authentication is required, and no local access to the target machine is needed.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose based on the Google Chrome Stable Update advisory.

Detection Methods for CVE-2026-78966

Indicators of Compromise

Chrome desktop clients reporting a version string below 152.0.7977.65 in browser telemetry or user-agent logs.
Outbound QUIC (UDP/443) sessions from endpoints to unfamiliar or newly registered domains hosting crafted HTML.
Web proxy or DNS logs showing user navigation to suspicious pages immediately followed by anomalous QUIC flows to third-party origins.

Detection Strategies

Inventory installed Chrome and Chromium-derivative browser versions across managed endpoints and flag builds below 152.0.7977.65.
Correlate browser process network activity with cross-origin resource access patterns that deviate from user browsing baselines.
Alert on QUIC handshakes to low-reputation destinations initiated by the browser process shortly after navigation events.

Monitoring Recommendations

Ingest browser version and update-channel telemetry into the SIEM to track patch compliance over time.
Monitor UDP/443 traffic volumes and destinations per host, since QUIC bypasses many TCP-focused inspection controls.
Track HTTP/3 request patterns from endpoints and investigate sessions where cross-origin access does not match expected application behavior.

How to Mitigate CVE-2026-78966

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on all Windows, macOS, and Linux desktops.
Force a browser relaunch through enterprise policy so pending updates apply on active user sessions.
Audit Chromium-based applications and Electron builds to confirm they consume a patched Chromium version.

Patch Information

Google released the fix in the Chrome Stable channel at version 152.0.7977.65. Deployment details are documented in the Google Chrome Stable Update announcement. The underlying code change is referenced in Chromium Issue Tracker #497637694. Administrators managing Chrome through enterprise policy should validate that auto-update is enabled and that the target version matches the Stable channel.

Workarounds

Disable QUIC in Chrome using the QuicAllowed enterprise policy set to false until the browser is updated. This forces fallback to TLS over TCP for HTTPS traffic.
Restrict outbound UDP/443 at the network perimeter for user segments where QUIC is not required for business applications.
Use web filtering to block newly registered or low-reputation domains that are common delivery vectors for crafted HTML pages.

bash

# Configuration example: disable QUIC via Chrome enterprise policy (Linux)
sudo mkdir -p /etc/opt/chrome/policies/managed
cat <<'EOF' | sudo tee /etc/opt/chrome/policies/managed/disable_quic.json
{
  "QuicAllowed": false
}
EOF