CVE-2026-79041: Google Chrome Authorization Bypass Vulnerability

CVE-2026-79041 Overview

CVE-2026-79041 is a missing authorization vulnerability in the Browser component of Google Chrome on macOS prior to version 152.0.7977.65. A remote attacker can leverage social engineering to bypass web origin policy and reach a privileged page through a crafted HTML page. The flaw is categorized under CWE-862: Missing Authorization and requires user interaction to succeed. Chromium classifies the security severity as Low, and the issue is limited to the macOS build of Chrome.

Critical Impact
An attacker who convinces a user to load a crafted HTML page can bypass the same-origin policy and interact with a privileged Chrome page on macOS.

Affected Products

Google Chrome on macOS prior to 152.0.7977.65
Apple macOS (as the affected platform for the Chrome build)
Chromium-based browsers on macOS that share the vulnerable Browser code paths

Discovery Timeline

2026-08-25 - CVE-2026-79041 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79041

Vulnerability Analysis

The vulnerability resides in the Chrome Browser process on macOS. The Browser process fails to enforce an authorization check when transitioning from web content to a privileged page. This gap lets a crafted web origin cross a trust boundary that should be reserved for Chrome-controlled surfaces. Because the affected surface is a privileged page, actions that follow the bypass execute in a higher-trust context than untrusted web content. The issue is macOS-specific and does not require attacker-side privileges, though it does require the user to interact with attacker-controlled content.

Root Cause

The root cause is a missing authorization check, tracked as CWE-862. Code paths that route navigation or messages toward a privileged Chrome page do not verify that the initiating origin is authorized to reach that destination. As a result, the web origin policy that normally isolates untrusted content from privileged pages is not consistently applied on macOS.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a crafted HTML page and lures a Chrome user on macOS to visit it, typically through phishing or another social engineering pretext. When the victim interacts with the page, Chrome performs an operation that reaches a privileged surface without the required authorization enforcement. Impact is limited to an integrity effect on the Chrome UI and its privileged surface; there is no reported confidentiality or availability impact in the CVSS vector. Refer to the Chromium Issue #518249083 and the Google Chrome Stable Update for the tracking record and fix notes.

Detection Methods for CVE-2026-79041

Indicators of Compromise

Chrome browser versions on macOS reporting a version earlier than 152.0.7977.65 in fleet inventory
User reports of unexpected Chrome internal or settings pages loading after visiting an external link
Outbound navigations from user mail clients or messaging apps to unfamiliar HTML landing pages followed by Chrome UI anomalies

Detection Strategies

Query endpoint inventory for installed Chrome versions on macOS and flag any host below 152.0.7977.65
Correlate web proxy logs with endpoint telemetry to identify users visiting newly registered or low-reputation domains that serve HTML payloads
Monitor Chrome update telemetry to confirm that stable channel updates are applying successfully on macOS endpoints

Monitoring Recommendations

Track Chrome auto-update status and surface hosts that have deferred or blocked updates on macOS
Alert on phishing indicators that specifically target macOS Chrome users, including HTML attachments with anchor navigation to chrome:// or similar internal schemes
Review browser crash and error telemetry on macOS for unexpected transitions into privileged Chrome pages

How to Mitigate CVE-2026-79041

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 152.0.7977.65 or later
Verify that Chrome auto-update is enabled and functioning on managed macOS devices
Reinforce user awareness of phishing and social engineering, since exploitation requires user interaction with a crafted HTML page

Patch Information

Google addressed CVE-2026-79041 in the Chrome stable channel update that shipped version 152.0.7977.65 for macOS. Details are published in the Google Chrome Stable Update release notes, with the underlying tracking record available at Chromium Issue #518249083. Administrators should confirm the deployed version in enterprise management tools after the update rolls out.

Workarounds

Restrict browsing to trusted sites through enterprise policy until the Chrome update is confirmed on all macOS endpoints
Use email and web filtering to block delivery of HTML attachments and links from untrusted senders
Consider temporarily standardizing on an alternative up-to-date browser on macOS hosts where the Chrome update cannot be applied immediately

bash

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force Chrome update check via the UI URL
open -a "Google Chrome" "chrome://settings/help"