CVE-2026-79005: Google Chrome Auth Bypass Vulnerability

CVE-2026-79005 Overview

CVE-2026-79005 is an incorrect authorization vulnerability [CWE-863] in the StorageAccessAPI component of Google Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass web origin policy by serving a crafted HTML page. Google's Chromium security team rated the internal severity as Low, while the NVD assigned a CVSS 3.1 score of 6.5. The flaw does not enable direct code execution but undermines the same-origin boundary that isolates web content between sites. Exploitation requires user interaction and a pre-existing renderer compromise, narrowing the practical attack scope to chained exploits.

Critical Impact
An attacker with a compromised renderer can bypass origin restrictions in the Storage Access API, enabling unauthorized cross-origin data access from a crafted page.

Affected Products

Google Chrome versions prior to 152.0.7977.65 (Desktop, Stable channel)
Chromium-based browsers incorporating the vulnerable StorageAccessAPI implementation
All operating systems supported by Chrome Stable (Windows, macOS, Linux)

Discovery Timeline

2026-08-25 - CVE-2026-79005 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79005

Vulnerability Analysis

The Storage Access API grants embedded third-party contexts scoped access to their unpartitioned cookies and storage after user or browser consent. The API enforces origin-based authorization to prevent one site from acting on behalf of another. In Chrome versions before 152.0.7977.65, the authorization check in StorageAccessAPI did not correctly validate the requesting context's origin against the granted permission scope.

An attacker who has compromised the renderer process can send crafted API requests that reference storage access grants belonging to other origins. Because the check is incorrect rather than missing, the flaw evades naive input validation and instead exploits a logic gap in how origin bindings are compared. The resulting integrity impact is high, while confidentiality and availability remain unaffected per the CVSS vector.

Root Cause

The root cause is an authorization logic defect classified under [CWE-863] (Incorrect Authorization). The StorageAccessAPI code path evaluates access decisions against attacker-controllable state within a compromised renderer, rather than enforcing origin binding solely in the trusted browser process. This weakens the web origin policy that Chrome's site isolation is designed to enforce.

Attack Vector

The attack requires two preconditions: a renderer process already compromised by a separate exploit, and a user visiting a crafted HTML page under the attacker's control. Once these conditions are met, the attacker issues Storage Access API calls that reference cross-origin permissions and obtains authorized access outside the attacker's origin. The vulnerability is typically chained after a memory corruption or type confusion bug in the renderer.

No verified public proof-of-concept code is available. Refer to the Chromium Issue Report #517540292 for technical details once access is granted.

Detection Methods for CVE-2026-79005

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 on managed endpoints.
Unexpected renderer process crashes or child process anomalies preceding cross-site data access events.
Web application telemetry showing cross-origin storage or cookie access from unexpected embedding contexts.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65.
Correlate renderer crash dumps with subsequent authentication or session anomalies on high-value web applications.
Monitor for browser exploitation precursors such as sandbox escape attempts, since this bug typically appears in a chain.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake for cross-source correlation of renderer anomalies and web session events.
Alert on Chrome installations that fall out of the supported version window defined by Google's Stable channel release notes.
Track visits to newly registered or low-reputation domains that serve HTML content immediately after renderer instability.

How to Mitigate CVE-2026-79005

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all endpoints, including kiosks and virtual desktops.
Force-restart Chrome processes after deployment to ensure the patched binary is loaded into memory.
Verify enterprise policy configurations do not defer or block automatic Chrome updates.

Patch Information

Google released the fix in the Stable channel update announced in the Chrome Releases blog. Upgrading to Chrome 152.0.7977.65 or later remediates the incorrect authorization in StorageAccessAPI. Chromium-based browsers should apply their vendor's corresponding update once available.

Workarounds

Deploy enterprise policy to disable the Storage Access API where business use cases permit, reducing the attack surface until patching completes.
Restrict third-party cookie access via BlockThirdPartyCookies policy to limit downstream impact of any bypass.
Enforce site isolation and strict SameSite cookie defaults to reduce the value of cross-origin access to attackers.

bash

# Configuration example: enforce Chrome auto-update and restrict third-party cookies via policy
# Windows registry (HKLM)
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v BlockThirdPartyCookies /t REG_DWORD /d 1 /f

# Verify installed Chrome version
"%ProgramFiles%\Google\Chrome\Application\chrome.exe" --version