CVE-2026-79017: Google Chrome Race Condition Vulnerability

CVE-2026-79017 Overview

CVE-2026-79017 is a race condition vulnerability in the Extensions component of Google Chrome prior to version 152.0.7977.65. A remote attacker can bypass system access restrictions by convincing a user to install a crafted Chrome extension. The flaw is classified under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition. Chromium's internal security assessment rates the severity as Low, while the NVD assigns a Medium CVSS score of 6.5. Exploitation requires user interaction, but no authentication is needed.

Critical Impact
A remote attacker can bypass Chrome extension system access restrictions using a crafted extension, resulting in integrity compromise on affected browsers.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers sharing the vulnerable Extensions component
Desktop platforms receiving the Chrome Stable channel update

Discovery Timeline

2026-08-25 - CVE-2026-79017 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79017

Vulnerability Analysis

The vulnerability resides in the Extensions subsystem of Google Chrome. A race condition allows a crafted extension to exploit a timing window between when Chrome validates access to a protected system resource and when that resource is actually used. This TOCTOU pattern enables the extension to perform actions that should be blocked by Chrome's permission and sandbox model.

Successful exploitation compromises integrity by bypassing system access restrictions enforced by the browser. The CVSS vector indicates network attack reach with required user interaction, since the victim must install the malicious extension. Confidentiality and availability impacts are not reported for this issue.

The attack path aligns with attacker techniques that abuse browser extensions as an initial foothold. Malicious extensions delivered through social engineering, sideloading, or supply-chain compromise of legitimate extensions are the most likely delivery mechanisms.

Root Cause

The root cause is an atomicity violation in the Extensions component. Chrome checks a security-relevant condition and then acts on it in a separate step, without ensuring the state has not changed in between. An attacker-controlled extension races this check to invalidate the assumption before the action is performed. Details are tracked in Chromium Issue #533021205.

Attack Vector

Exploitation begins when a user installs a crafted Chrome extension. Once loaded, the extension triggers the race window during interaction with Chrome APIs that enforce system access controls. Winning the race lets the extension operate outside the boundaries expected by the browser's permission model. No elevated privileges or credentials are required on the target system.

No public proof-of-concept, ExploitDB entry, or CISA KEV listing exists for CVE-2026-79017 at time of publication. The EPSS model estimates a low near-term probability of observed exploitation.

Detection Methods for CVE-2026-79017

Indicators of Compromise

Chrome extensions installed outside the Chrome Web Store or through developer mode on managed endpoints
Extensions requesting broad host permissions or access to chrome:// and file system APIs
Chrome process versions older than 152.0.7977.65 running in production environments
Recently loaded unpacked extensions with obfuscated background.js or service_worker scripts

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and match extension IDs against an approved allowlist
Alert on Chrome versions below 152.0.7977.65 reported by endpoint telemetry or software inventory tooling
Monitor process telemetry for Chrome child processes performing unexpected file, registry, or IPC operations following extension load events

Monitoring Recommendations

Ingest Chrome extension install and update events into your SIEM for continuous review
Correlate extension installation events with subsequent access to sensitive local resources
Track user reports of unexpected browser behavior after installing new extensions

How to Mitigate CVE-2026-79017

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all endpoints
Audit all installed Chrome extensions and remove any that are unknown, unused, or from untrusted publishers
Enforce Chrome auto-update policies through group policy or MDM to prevent version drift
Restrict extension installation to a curated allowlist using the ExtensionInstallAllowlist policy

Patch Information

Google addressed CVE-2026-79017 in the Chrome Stable channel release 152.0.7977.65. See the Google Chrome Stable Update advisory for the full release notes and the Chromium Issue #533021205 tracker for technical context.

Workarounds

Block installation of extensions from unmanaged sources using enterprise policy until patching completes
Disable Chrome developer mode on managed devices to prevent unpacked extension loading
Apply ExtensionInstallBlocklist with a wildcard value and use an allowlist to permit only vetted extensions

bash

# Example Chrome enterprise policy (Linux managed_policies)
# /etc/opt/chrome/policies/managed/extensions.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "DeveloperToolsAvailability": 2,
  "ExtensionSettings": {
    "*": {
      "installation_mode": "blocked",
      "blocked_install_message": "Extension installation is managed by IT."
    }
  }
}