CVE-2026-78967 Overview
CVE-2026-78967 is a missing authorization vulnerability [CWE-862] in the Back-Forward Cache (BFCache) component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass system access restrictions by serving a crafted HTML page. Google's Chromium security team rated the issue Medium severity.
The vulnerability requires a prior renderer compromise as a prerequisite. Once staged, it enables the attacker to reach resources or actions that BFCache should have gated behind an authorization check.
Critical Impact
An attacker controlling a compromised renderer process can bypass browser system access restrictions through a crafted HTML page, expanding the impact of an initial renderer exploit.
Affected Products
- Google Chrome for Desktop prior to 152.0.7977.65
- Chromium-based builds incorporating the vulnerable BFCache logic
- Downstream browsers that ship Chromium prior to the fixed milestone
Discovery Timeline
- 2026-08-25 - CVE-2026-78967 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD
Technical Details for CVE-2026-78967
Vulnerability Analysis
BFCache stores full page snapshots (document, JavaScript heap, and frame tree state) so that back and forward navigations restore instantly without reloading. Pages stored in BFCache retain sensitive contextual state, and privileged operations must reverify authorization when a page is restored or interacts with browser-mediated APIs.
CVE-2026-78967 stems from a missing authorization check on a BFCache-mediated code path. When a renderer that the attacker already controls interacts with the affected path, Chrome fails to enforce the access decision that would normally protect system-level restrictions. The result is a sandbox-adjacent bypass: the attacker uses BFCache state handling to reach capabilities that policy should have blocked.
The issue is chainable rather than standalone. A renderer compromise is a hard prerequisite, so exploitation follows an initial bug (for example, a V8 or Blink memory-safety flaw) that gives the adversary code execution inside the sandboxed renderer.
Root Cause
The root cause is an absent authorization check [CWE-862] in the BFCache code path. The affected logic trusts caller state instead of independently validating whether the requested operation is permitted for the current security context, allowing a hostile renderer to reach protected functionality.
Attack Vector
Exploitation is remote over the web. The attacker delivers a crafted HTML page to a target that has already been compromised at the renderer level. The page drives BFCache interactions that reach the unchecked path, bypassing system access restrictions. No verified public exploit or proof of concept is available at publication. EPSS is 0.377% (percentile 30.566) as of 2026-08-27.
No verified proof-of-concept code is publicly available. See the Chromium Issue Tracker #514529599 and the Google Chrome Stable Update for vendor details.
Detection Methods for CVE-2026-78967
Indicators of Compromise
- Chrome processes at versions below 152.0.7977.65 observed after the patch release window.
- Renderer processes exhibiting anomalous IPC patterns to the browser process immediately following back/forward navigation events.
- Unexpected access to system resources originating from a browser child process context.
Detection Strategies
- Inventory installed browsers and flag Chrome or Chromium-derivative builds older than 152.0.7977.65.
- Hunt for signs of prior renderer compromise, since this bug requires one: unusual child-process spawns, sandbox escapes, or crash telemetry from chrome.exe renderer processes.
- Correlate browser telemetry with EDR process-lineage data to identify browser children performing filesystem or network actions inconsistent with normal browsing.
Monitoring Recommendations
- Ingest browser version telemetry into your SIEM or data lake and alert on versions below 152.0.7977.65.
- Monitor renderer crash reports and Chromium enterprise reporting events for indicators of exploitation attempts against renderer components.
- Track outbound connections from browser processes to newly registered or low-reputation domains that serve executable HTML/JS payloads.
How to Mitigate CVE-2026-78967
Immediate Actions Required
- Update Google Chrome to 152.0.7977.65 or later on all managed endpoints.
- Force-restart Chrome after deployment so the patched binary is actually loaded; BFCache lives inside long-running processes.
- Validate Chromium-based third-party browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding upstream updates.
Patch Information
Google addressed CVE-2026-78967 in the Chrome Stable channel at version 152.0.7977.65. Details are published in the Google Chrome Stable Update announcement and tracked in Chromium Issue #514529599.
Workarounds
- No vendor-supplied workaround exists; patching is the supported remediation.
- Reduce residual risk by enforcing Chrome auto-update via enterprise policy and blocking downgrade to older Chrome installers.
- Restrict browsing to trusted destinations for high-value users until patch rollout completes, since exploitation requires the user to load attacker-controlled HTML after a renderer compromise.
# Verify Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
# Verify Chrome version on Linux
google-chrome --version
# Enforce minimum version via Chrome Enterprise policy (Windows registry)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "152.0.7977.65" /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
