CVE-2026-78968: Google Chrome Auth Bypass Vulnerability

CVE-2026-78968 Overview

CVE-2026-78968 is a missing authorization vulnerability [CWE-862] in the Core component of Google Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can spoof the address bar contents through a crafted HTML page. The flaw requires user interaction and does not directly grant code execution or data disclosure, but it enables convincing phishing and social engineering attacks by misrepresenting the origin displayed to the user. Google has classified the underlying Chromium security severity as Low, while NVD assigns a medium overall score based on integrity impact.

Critical Impact
Attackers with a compromised renderer can spoof the Chrome address bar, enabling high-fidelity phishing pages that appear to originate from trusted domains.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers embedding the affected Core component
Enterprise deployments of Chrome managed via Google Update channels

Discovery Timeline

2026-08-25 - CVE-2026-78968 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78968

Vulnerability Analysis

The vulnerability resides in the Core component of Chrome, which manages navigation state and the security UI that renders the omnibox. Chrome relies on the browser process to authoritatively track the committed URL for a tab. When authorization checks between the renderer and browser process are missing or incomplete, a compromised renderer can influence which URL the browser process reflects in the address bar.

An attacker who already controls a renderer, typically after chaining a separate memory corruption or logic bug, can craft an HTML page that triggers the flawed navigation path. The browser then displays a URL that does not match the actual document origin. The vulnerability requires user interaction, as the victim must load the crafted page or follow a link into the malicious context.

While the flaw does not by itself compromise confidentiality or availability, integrity of the security indicators is broken. Users rely on the omnibox to make trust decisions, so spoofing it undermines phishing defenses and TLS origin verification.

Root Cause

The root cause is a missing authorization check [CWE-862] in the browser-side navigation logic that accepts state from a renderer without validating that the renderer is authorized to represent the claimed origin.

Attack Vector

Exploitation requires two conditions: prior compromise of the renderer process and user interaction with a crafted HTML page. The attacker delivers the page through a malicious website, compromised third-party content, or a link in email or messaging. Once the renderer is under attacker control, the crafted page manipulates navigation such that the omnibox displays an attacker-chosen URL while the underlying document remains malicious.

See the Chromium Issue Tracker entry and the Google Chrome Stable Update advisory for vendor details.

Detection Methods for CVE-2026-78968

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 on managed endpoints
Renderer processes exhibiting unexpected navigation or history state changes without matching browser process navigation events
Outbound connections to phishing infrastructure following legitimate-looking address bar content in user reports

Detection Strategies

Inventory installed Chrome versions across the fleet and flag hosts below 152.0.7977.65 as vulnerable.
Correlate user-reported phishing incidents with the Chrome version on the reporting endpoint to surface potential in-the-wild abuse.
Monitor for renderer crashes or exploitation artifacts that typically precede a chained address bar spoof.

Monitoring Recommendations

Ingest browser telemetry and endpoint process events into a central data lake for version and behavioral analysis.
Alert on Chrome child processes spawning unusual descendants or communicating with known phishing domains.
Track Google Chrome release channel announcements and reconcile deployed versions on a recurring basis.

How to Mitigate CVE-2026-78968

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Force a browser restart after update deployment to ensure the patched binary is loaded.
Verify that enterprise policies allow automatic updates and that update servers are reachable.

Patch Information

Google addressed the vulnerability in the Stable Channel update covered by the Chrome Releases blog post. Administrators should confirm the version string reported by chrome://version is 152.0.7977.65 or higher.

Workarounds

No official workaround exists. Reduce exposure by restricting browsing to trusted sites and enforcing Enhanced Safe Browsing.
Reinforce user training to verify TLS certificates and page content when transacting on sensitive sites.
Deploy DNS and web filtering to block known phishing infrastructure that could weaponize the spoof.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Verify installed Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version