CVE-2026-79006: Google Chrome Auth Bypass Vulnerability

CVE-2026-79006 Overview

CVE-2026-79006 is a protection mechanism failure in the HttpsUpgrades component of Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to bypass web origin policy through crafted network traffic. Google's Chromium project has rated the security severity as Medium. The weakness maps to [CWE-693: Protection Mechanism Failure], indicating the browser's automatic HTTPS upgrade logic fails to enforce the expected origin boundary under adversarial network conditions.

Critical Impact
An attacker positioned to manipulate network traffic can bypass Chrome's HTTPS upgrade protection, undermining same-origin guarantees that separate trusted web content from attacker-controlled resources.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers that inherit the HttpsUpgrades component
Downstream distributions bundling vulnerable Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79006 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79006

Vulnerability Analysis

The HttpsUpgrades feature in Chrome automatically upgrades navigations from HTTP to HTTPS to reduce exposure to passive network attackers. The vulnerability breaks that guarantee. A remote attacker who can shape network traffic reaching the browser can cause Chrome to violate its web origin policy, treating content across origin boundaries in ways the security model does not permit.

Origin policy enforcement underpins cookie scoping, storage isolation, and script access controls. A bypass in the upgrade path allows attacker-influenced content to be handled with trust that belongs to a different origin. The Chromium project rates the issue Medium severity. The EPSS probability is 0.261% at the 17.5 percentile, indicating current exploitation likelihood is low.

Root Cause

The root cause is classified under [CWE-693]. The HttpsUpgrades logic fails to apply the intended protection consistently. Specific implementation details are tracked in Chromium Issue #502344135, which remains access-restricted per Chromium's standard embargo practice.

Attack Vector

Exploitation requires the attacker to influence network traffic reaching a victim's browser. This aligns with a network-adjacent or on-path adversary model, such as a hostile Wi-Fi operator, a compromised upstream proxy, or a malicious network intermediary. The attacker crafts responses that manipulate how HttpsUpgrades resolves the target origin, producing a state that violates same-origin expectations.

No authentication is required on the target and no local access to the endpoint is needed. Public proof-of-concept code has not been published. See the Chrome Releases stable channel update for vendor context.

Detection Methods for CVE-2026-79006

Indicators of Compromise

Chrome desktop clients reporting versions below 152.0.7977.65 in browser inventory telemetry.
Unexpected HTTP-to-HTTPS redirect anomalies or origin mismatches in web proxy and TLS inspection logs.
Traffic patterns consistent with on-path interception, such as unusual certificate substitutions on managed networks.

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions across managed endpoints and flag builds prior to 152.0.7977.65.
Correlate browser version data with authenticated network egress logs to identify users browsing from vulnerable builds on untrusted networks.
Review web application logs for anomalous cross-origin behavior originating from clients on hostile network segments.

Monitoring Recommendations

Continuously monitor endpoint browser versions and enforce a minimum patched build through management tooling.
Alert on Chrome auto-update failures, which leave hosts on vulnerable versions longer than the fleet baseline.
Track TLS termination and HSTS preload behavior on corporate proxies to surface interception attempts against upgraded connections.

How to Mitigate CVE-2026-79006

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on all managed desktops.
Force a browser restart after deployment to complete the upgrade, since Chrome applies patches only on relaunch.
Audit Chromium-based browsers such as Edge, Brave, and Opera and apply their vendor updates that incorporate the fix.

Patch Information

Google addressed CVE-2026-79006 in Chrome Stable 152.0.7977.65. Details are documented in the Chrome Releases stable channel update and tracked in Chromium Issue #502344135. Administrators should validate patch deployment through the browser's chrome://version page or enterprise management reporting.

Workarounds

Restrict browsing from untrusted networks until patched builds are deployed across the fleet.
Enforce HSTS preloading and DNS-over-HTTPS to reduce the attacker's ability to manipulate upgrade behavior.
Use enterprise policy to disable stale browser installations that cannot receive updates.

bash

# Verify Chrome version on Linux managed endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv