CVE-2026-79015: Chrome ServiceWorker Auth Bypass Flaw

CVE-2026-79015 Overview

CVE-2026-79015 is an improper input validation vulnerability in the ServiceWorker component of Google Chrome. Versions prior to 152.0.7977.65 are affected. A remote attacker can bypass system access restrictions by serving a crafted HTML page to a target user. Successful exploitation requires user interaction, such as visiting an attacker-controlled page. The Chromium project classified the security severity as Low, and the flaw is tracked under [CWE-20]. Google addressed the issue in the Stable channel update for desktop.

Critical Impact
A crafted HTML page can bypass system access restrictions enforced through Chrome's ServiceWorker, exposing browser integrity boundaries to remote attackers.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable ServiceWorker code
Downstream distributions bundling pre-patch Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79015 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79015

Vulnerability Analysis

The vulnerability resides in Chrome's ServiceWorker implementation, a background script mechanism used for network interception, caching, and offline functionality. Improper input validation ([CWE-20]) allows a crafted HTML page to influence ServiceWorker behavior in ways that bypass Chrome's system access restrictions. The flaw affects confidentiality boundaries to a limited degree and requires the victim to interact with attacker-controlled content. No privileges are required on the target system. The Chromium team classified the underlying issue as Low security severity in their internal grading. Public technical details are limited to the Chromium Issue Tracker entry.

Root Cause

The root cause is missing or insufficient validation of input handled by the ServiceWorker code path. Because ServiceWorkers mediate requests between the page and the network stack, weak validation can allow a page to influence decisions that should be gated by browser-enforced access controls. The result is a targeted restriction bypass rather than arbitrary code execution.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures the victim to visit it, for example through phishing, malvertising, or a compromised site. When the page loads and registers or interacts with a ServiceWorker, the malformed input bypasses access restrictions the browser is expected to enforce. No authentication or prior foothold is required on the victim's system.

No verified proof-of-concept code is publicly available. See the Google Chrome Stable Update advisory and the Chromium Issue Tracker #522291712 for vendor-provided context.

Detection Methods for CVE-2026-79015

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 after the patch release date
Unexpected ServiceWorker registrations from newly visited or low-reputation domains
Browser telemetry showing anomalous fetch or cache activity originating from ServiceWorker scopes

Detection Strategies

Inventory endpoint Chrome versions and flag hosts running builds below 152.0.7977.65
Monitor proxy and DNS logs for user navigation to suspicious domains that immediately register ServiceWorkers
Correlate browser process telemetry with visits to unclassified or newly registered domains

Monitoring Recommendations

Ingest browser version and update-state telemetry into the SIEM for continuous compliance checks
Alert on Chrome installations that fail to auto-update within the vendor's supported patch window
Track outbound web traffic patterns tied to ServiceWorker scopes for anomalies after user interaction with untrusted pages

How to Mitigate CVE-2026-79015

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Verify enterprise update policies allow the Stable channel to deliver the fix without delay
Restart browser sessions after update to ensure the patched binary is loaded

Patch Information

Google fixed the vulnerability in Chrome Stable 152.0.7977.65. Details are published in the Chrome Releases blog. Chromium-based browsers should pull the corresponding upstream fix referenced in Chromium Issue #522291712.

Workarounds

Restrict browsing to trusted sites through web proxy or DNS filtering until patching completes
Enforce Chrome enterprise policies that disable ServiceWorker registration on sensitive user profiles where feasible
Train users to avoid clicking links in unsolicited messages, since exploitation requires user interaction

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv