CVE-2026-79000: Google Chrome Auth Bypass Vulnerability

CVE-2026-79000 Overview

CVE-2026-79000 is an improper input validation vulnerability [CWE-20] in the DeviceBoundSessionCredentials component of Google Chrome. Versions prior to 152.0.7977.65 are affected. A remote attacker who successfully lures a user through social engineering can send crafted network traffic to bypass the web origin policy. Chromium rates the security severity as Low. The flaw does not enable direct code execution, but a same-origin bypass can undermine site isolation guarantees that browsers rely on to protect authenticated sessions and cross-origin data.

Critical Impact
A remote attacker leveraging social engineering can bypass the web origin policy in Chrome via crafted network traffic, weakening isolation between origins for users on unpatched builds.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable DeviceBoundSessionCredentials implementation
Downstream distributions that had not yet incorporated the Chromium 152 stable channel fix

Discovery Timeline

2026-08-25 - CVE-2026-79000 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79000

Vulnerability Analysis

The vulnerability resides in Chrome's DeviceBoundSessionCredentials (DBSC) implementation. DBSC binds session credentials to a device-held cryptographic key so that cookies cannot be replayed from another host. The affected code path fails to properly validate input received over the network. An attacker can craft traffic that Chrome parses in a way that violates web origin policy assumptions, effectively allowing session or credential state associated with one origin to influence behavior in another. Exploitation requires user interaction driven by social engineering, such as visiting an attacker-controlled page or clicking a crafted link. The issue is a logic and validation flaw rather than a memory corruption defect, which is why Chromium assigned it a Low severity rating even though the impact touches the browser's origin boundary.

Root Cause

The root cause is missing or insufficient validation of attacker-controlled fields in the DBSC handshake and refresh flow. Chrome accepted values that should have been rejected against the current document origin, allowing a mismatch between the credential-bound origin and the requesting context.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a malicious page or intermediary that delivers crafted DBSC-related network traffic. The victim must be convinced through social engineering to browse to the attacker's endpoint while using a vulnerable Chrome build. Successful exploitation weakens origin enforcement rather than directly executing code. Full technical details are tracked in the Chromium Issue Tracker entry #502514083.

No public proof-of-concept has been released, and no verified exploitation code is available. See the Google Chrome Stable Update announcement for release notes.

Detection Methods for CVE-2026-79000

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-79000.
Anomalous outbound HTTPS traffic to newly registered domains immediately after user clicks on links delivered by email, chat, or ads.
Chrome browser telemetry showing installed versions below 152.0.7977.65 on managed endpoints.

Detection Strategies

Inventory Chrome versions across the fleet and flag any host running a build older than 152.0.7977.65.
Correlate browser process telemetry with DNS and HTTP telemetry to surface social-engineering landing pages preceding suspicious authenticated requests.
Alert on browser sessions that authenticate to sensitive applications from unusual origins or referrers shortly after visits to untrusted domains.

Monitoring Recommendations

Feed browser process, DNS, and web proxy logs into a centralized data lake to enable cross-source correlation.
Monitor for phishing themes that request the user to open links in Chrome specifically, a common precursor to browser-targeted exploitation.
Track privileged users and administrators for signs of session anomalies after browsing events.

How to Mitigate CVE-2026-79000

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Force-restart the browser after policy-driven updates to ensure the patched binary is loaded.
Update Chromium-based browsers and embedded runtimes once vendors ship the corresponding fix.

Patch Information

Google addressed CVE-2026-79000 in the Chrome Stable channel release 152.0.7977.65. Refer to the Google Chrome Stable Update advisory for release notes and the Chromium Issue Tracker #502514083 for the underlying bug reference. Administrators using enterprise policy should verify that ChromeCleanupEnabled and update policies allow automatic distribution of the patched build.

Workarounds

Enforce Chrome auto-update via Group Policy or MDM to accelerate patch adoption.
Deliver user awareness reminders about social-engineering lures that instruct victims to click links or open specific URLs.
Restrict access to sensitive web applications from browser builds below the fixed version using conditional access or device posture checks.

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify on Linux
google-chrome --version