CVE-2026-79011: Google Chrome UI Auth Bypass Vulnerability

CVE-2026-79011 Overview

CVE-2026-79011 is a user interface (UI) misrepresentation vulnerability in the Browser component of Google Chrome prior to version 152.0.7977.65. A remote attacker can leverage social engineering with a crafted HTML page to bypass system access restrictions. The Chromium project rated the security severity as High. The weakness is classified as [CWE-451] User Interface Misrepresentation of Critical Information, commonly known as UI spoofing.

Critical Impact
Attackers can present misleading browser UI elements to trick users into granting access or trusting malicious content, bypassing security prompts that normally gate system access.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers that inherit the vulnerable Browser UI code path
Downstream distributions bundling pre-152 Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79011 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79011

Vulnerability Analysis

The flaw resides in the Browser process, which is responsible for rendering trusted UI chrome such as the address bar, permission prompts, and security indicators. Chrome fails to correctly represent authoritative UI state when a crafted HTML page manipulates the surrounding rendering context. Because the misrepresentation targets user-facing UI rather than memory safety, exploitation depends on convincing a user to interact with the crafted page.

According to the vendor advisory, a remote attacker leveraging social engineering can bypass system access restrictions. The bypass affects permission or gating flows normally shown by the browser before granting resource access. The Chromium project has confirmed the internal severity as High. See the Google Chrome Stable Update and Chromium Issue Tracker #517736936 for vendor disclosure details.

Root Cause

The root cause is inconsistent handling of UI element rendering between renderer-provided content and Browser-controlled security surfaces. This category ([CWE-451]) arises when the browser trusts attacker-influenced layout, timing, or focus state to place critical prompts. The result is that security-relevant dialogs or origin indicators can be obscured, spoofed, or reordered so that user consent is captured under false pretenses.

Attack Vector

Exploitation requires a victim to load a crafted HTML page and perform interaction such as clicks, focus changes, or dismissal of overlays. The attacker chains the visual deception with a legitimate access prompt to obtain permissions the user would otherwise deny. No authentication is required, and the attack proceeds over standard HTTPS delivery. The exploit does not yield direct code execution; it degrades the integrity of the browser's security UI contract.

No verified proof-of-concept code has been published. Technical specifics of the crafted markup are restricted in the Chromium Issue Tracker #517736936 pending broad patch adoption.

Detection Methods for CVE-2026-79011

Indicators of Compromise

Chrome browser processes reporting a version string below 152.0.7977.65 in enterprise inventory telemetry.
Web proxy logs showing repeated user visits to unfamiliar domains that host full-window HTML overlays, fullscreen requests, or picture-in-picture abuse.
User reports of permission prompts, download dialogs, or address bar content that appeared inconsistent with the site being visited.

Detection Strategies

Inventory endpoints by installed Chrome version and flag any host running a build older than 152.0.7977.65.
Correlate browser telemetry with subsequent permission grants (camera, microphone, geolocation, file system access) originating from low-reputation domains.
Hunt for phishing infrastructure serving HTML that requests fullscreen or pointer lock immediately on load, a common precursor to UI spoofing.

Monitoring Recommendations

Enable Chrome Enterprise reporting to stream browser version and extension telemetry to a central data lake for continuous version compliance auditing.
Monitor DNS and TLS SNI logs for newly registered domains referenced by user-submitted phishing reports tied to browser prompts.
Alert on file downloads or credential submissions that follow interaction with sites hosting fullscreen HTML content.

How to Mitigate CVE-2026-79011

Immediate Actions Required

Update all Google Chrome desktop installations to version 152.0.7977.65 or later across Windows, macOS, and Linux fleets.
Update Chromium-based browsers (Edge, Brave, Opera, Vivaldi) once vendors publish builds incorporating the upstream fix.
Restart browser sessions after update deployment to ensure the Browser process reloads patched UI code.
Reinforce user awareness that legitimate permission prompts originate from the browser and cannot be replicated by page content.

Patch Information

Google released the fix in the Chrome Stable channel with build 152.0.7977.65. Refer to the Google Chrome Stable Update release notes for the full advisory and companion CVEs shipped in the same update.

Workarounds

Deploy Chrome Enterprise policies that restrict fullscreen, pointer lock, and permission prompts on untrusted origins until patching completes.
Enable Safe Browsing Enhanced Protection to increase interstitial coverage for suspicious HTML pages used in social engineering.
Use URL filtering or Secure Web Gateway categories to block newly registered and uncategorized domains for high-risk user groups.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query the registry for installed Chrome version
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Chrome Enterprise policy example (JSON) to enforce automatic updates
# and disable risky UI surfaces on unknown origins
{
  "DefaultFullscreenSetting": 2,
  "DefaultPointerLockSetting": 2,
  "SafeBrowsingProtectionLevel": 2,
  "ComponentUpdatesEnabled": true,
  "TargetVersionPrefix": "152."
}