CVE-2026-79031: Google Chrome Auth Bypass Vulnerability

CVE-2026-79031 Overview

CVE-2026-79031 is an improper resource exposure vulnerability in the Preload component of Google Chrome. The flaw affects versions prior to 152.0.7977.65 and allows a remote attacker to bypass site isolation using a crafted HTML page. Chromium security engineers rated the underlying issue as Medium severity. The weakness is tracked under CWE-668: Exposure of Resource to Wrong Sphere and undermines a core browser security boundary designed to keep cross-origin content separated.

Critical Impact
A remote attacker who convinces a user to load a crafted HTML page can bypass Chrome's site isolation, exposing cross-site resources that should remain segregated between renderer processes.

Affected Products

Google Chrome (Desktop) versions prior to 152.0.7977.65
Chromium-based browsers that inherit the vulnerable Preload implementation
Downstream distributions bundling the pre-patch Chromium engine

Discovery Timeline

2026-08-25 - CVE-2026-79031 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79031

Vulnerability Analysis

The vulnerability resides in Chrome's Preload subsystem, which fetches resources in advance to reduce page load latency. Preload hints instruct the browser to retrieve scripts, stylesheets, fonts, and other subresources before the parser encounters them. The implementation improperly exposed a resource across the isolation boundary that site isolation is designed to enforce.

Site isolation places documents from different sites into separate renderer processes. This process-level separation defends against speculative execution attacks such as Spectre and cross-origin data leaks. When Preload mishandles resource scoping, an attacker can observe or access content that should have remained confined to another origin's renderer.

The issue is tracked in Chromium Issue Tracker #503472696 and was fixed in the stable channel update documented in the Google Chrome Stable Update announcement.

Root Cause

The root cause is improper resource exposure [CWE-668] within the Preload code path. Preloaded resources were not correctly bound to the requesting site's isolation context, allowing content associated with one origin to become reachable in a context governed by another.

Attack Vector

Exploitation requires a remote attacker to serve a crafted HTML page and lure a victim to visit it. No authentication or elevated privileges are required on the target system. Once loaded, the page uses malformed or attacker-controlled preload directives to trigger the site isolation bypass and access cross-site data that should be inaccessible.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.392%.

Detection Methods for CVE-2026-79031

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 on managed endpoints
Outbound requests to unfamiliar domains hosting HTML pages with unusual <link rel="preload"> or Link: HTTP header patterns
Renderer process crashes or anomalous cross-origin fetches recorded in browser telemetry

Detection Strategies

Inventory installed browser versions across the fleet and flag Chrome installations below 152.0.7977.65
Inspect proxy and web gateway logs for HTML responses containing suspicious preload directives targeting cross-origin resources
Correlate browser process telemetry with navigation events to identify pages triggering abnormal preload behavior

Monitoring Recommendations

Enable browser update compliance reporting through enterprise management tooling
Forward Chrome enterprise telemetry and endpoint process data into a centralized analytics platform for version and behavior monitoring
Alert on repeated navigations to newly registered or low-reputation domains that serve HTML with dense preload metadata

How to Mitigate CVE-2026-79031

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched renderer and network service binaries are loaded
Audit Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the upstream fix

Patch Information

Google released the fix in the Chrome Stable channel. Refer to the Google Chrome Stable Update announcement for the full changelog and to Chromium Issue Tracker #503472696 for developer-level details. Enterprise administrators should push the update via Chrome Browser Cloud Management, Group Policy, MDM, or their software distribution platform.

Workarounds

No official workaround exists; patching to 152.0.7977.65 or later is the supported remediation
Restrict browsing to trusted sites using web filtering or allow-listing until the update is deployed
Confirm that Site Isolation remains enabled through the SitePerProcess enterprise policy to maintain defense-in-depth on patched builds

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Enforce Site Isolation via enterprise policy (Linux example)
cat <<EOF | sudo tee /etc/opt/chrome/policies/managed/site_isolation.json
{
  "SitePerProcess": true,
  "IsolateOrigins": "https://*"
}
EOF