CVE-2026-78979 Overview
CVE-2026-78979 is a race condition [CWE-362] in the Core component of Google Chrome on Windows before version 152.0.7977.65. A remote attacker can leverage social engineering and a crafted HTML page to bypass web origin policy enforcement. Google's Chromium security team rates the issue Low severity, and no public exploitation has been reported.
The flaw affects the same-origin trust boundary that isolates content between websites. Successful exploitation requires user interaction with attacker-controlled content, which reduces practical impact but does not eliminate risk for targeted users.
Critical Impact
A crafted HTML page can win a timing race in Chrome Core to bypass web origin policy on Windows hosts running Chrome before 152.0.7977.65.
Affected Products
- Google Chrome for Windows prior to 152.0.7977.65
- Chromium-based browsers on Windows that share the vulnerable Core code path
- Enterprise Chrome deployments on Windows not yet updated to the Stable channel fix
Discovery Timeline
- 2026-08-25 - CVE-2026-78979 published to the National Vulnerability Database
- 2026-08-26 - Entry last modified in NVD
Technical Details for CVE-2026-78979
Vulnerability Analysis
The defect is a race condition in Chrome's Core module on Windows. Two concurrent operations execute without adequate synchronization, and an attacker who controls page content can influence timing to reach an inconsistent state. In that state, the browser evaluates a resource or navigation against the wrong origin context, allowing content from one origin to observe or act on another origin.
Bypassing web origin policy undermines the same-origin model that separates cookies, storage, DOM access, and script execution between sites. The Chromium project rated the severity Low, which typically indicates the attack requires specific conditions such as user interaction and does not by itself yield code execution.
Exploitation requires social engineering. The victim must load a crafted HTML page under attacker control. Once loaded, the page attempts to trigger the race window repeatedly until origin isolation checks fail.
Root Cause
Race conditions [CWE-362] arise when concurrent execution paths access shared state without proper locking or ordering guarantees. In this case, a security decision in Chrome Core depends on state that another thread or task can mutate during the check-to-use window. See the Chromium issue tracker entry for the upstream ticket.
Attack Vector
The attacker hosts a crafted HTML page and lures a Windows Chrome user to open it. The page issues carefully timed operations (for example, navigations, workers, or resource loads) to hit the race window. When the race is won, cross-origin data or actions become accessible from the attacker's origin.
No verified proof-of-concept code is available. Refer to the Chrome Stable Channel Update and the linked Chromium issue for authoritative technical detail.
Detection Methods for CVE-2026-78979
Indicators of Compromise
- Chrome for Windows process versions below 152.0.7977.65 observed in endpoint inventory
- Repeated visits from managed hosts to unfamiliar external HTML pages delivered via email, chat, or ad networks
- Unexpected cross-origin data access patterns in browser telemetry or web application logs
Detection Strategies
- Inventory Chrome versions across Windows endpoints and flag any installation below 152.0.7977.65.
- Correlate phishing and smishing campaign indicators with browser navigation events to identify social-engineering delivery.
- Review web application logs for anomalous requests that suggest same-origin policy circumvention against sensitive apps.
Monitoring Recommendations
- Track Chrome auto-update status and surface stale installations to patch management workflows.
- Alert on user reports of unexpected authentication prompts or session behavior after visiting external links.
- Monitor threat intelligence feeds for exploit publication tied to Chromium issue 503720291.
How to Mitigate CVE-2026-78979
Immediate Actions Required
- Update Google Chrome on all Windows endpoints to 152.0.7977.65 or later.
- Force a browser relaunch after update so patched code is loaded into running processes.
- Verify third-party Chromium-based browsers on Windows have absorbed the upstream fix.
Patch Information
Google released the fix in the Chrome Stable channel for desktop. Administrators should deploy Chrome 152.0.7977.65 or later on Windows systems. Full release notes are available in the Chrome Stable Channel Update announcement.
Workarounds
- Enforce Chrome auto-update via Group Policy or the Chrome Browser Cloud Management console.
- Restrict access to untrusted external HTML content through web filtering and email security controls until patching is complete.
- Train users to recognize social engineering lures that direct them to unfamiliar web pages.
# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
# Example Group Policy registry key to force Chrome auto-update
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
