CVE-2026-79049: Google Chrome Auth Bypass Vulnerability

CVE-2026-79049 Overview

CVE-2026-79049 is an incorrect reference resolution vulnerability in the Passwords component of Google Chrome prior to version 152.0.7977.65. A remote attacker can bypass system access restrictions by delivering a crafted file to a target user. Google's Chromium team rated the security severity as Medium and classified the weakness under CWE-706: Use of Incorrectly-Resolved Name or Reference. The flaw affects the credential-handling subsystem responsible for stored password references and their associated file resources.

Critical Impact
A remote attacker can bypass system access restrictions in Chrome's Passwords component using a crafted file, potentially exposing credential data or enabling unauthorized resource access.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Passwords component
Downstream distributions that had not yet integrated the Stable channel update

Discovery Timeline

2026-08-25 - CVE-2026-79049 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79049

Vulnerability Analysis

The vulnerability resides in Chrome's Passwords feature and stems from incorrect reference resolution [CWE-706]. When Chrome processes a crafted file, the browser resolves a name or reference to an unintended target. This mismatch between the intended and the resolved resource allows a remote attacker to reach data or capabilities that should be blocked by system access restrictions.

The EPSS score of the issue reflects a low likelihood of near-term exploitation activity, and Chromium security assigned the finding a Medium severity rating. No public proof-of-concept is currently available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Additional technical context is available in the Chromium Issue Tracker Entry and the Google Chrome Desktop Update announcement.

Root Cause

The root cause is an incorrectly resolved name or reference within Chrome's Passwords component. The browser trusts a reference derived from attacker-controlled input in a crafted file and resolves it against a resource outside the intended scope. This class of defect commonly arises when path, symbolic link, or identifier resolution occurs without adequate normalization or restriction to a trusted directory or namespace.

Attack Vector

Exploitation requires the victim to open or process a crafted file in Chrome. The file drives the Passwords component to resolve a reference that bypasses expected system access restrictions. Because interaction with a supplied file is necessary, delivery typically involves social engineering, malicious downloads, or compromised web content that stages the file for the browser.

No verified public exploit code exists for CVE-2026-79049. Refer to the Chromium Issue Tracker Entry for developer-level detail once access restrictions on the report are lifted.

Detection Methods for CVE-2026-79049

Indicators of Compromise

Chrome browser processes reading or referencing files outside the standard user profile directory shortly after opening an untrusted file
Unexpected access to password store files (Login Data, Login Data For Account) or their journal artifacts
Delivery of unusual file types to endpoints followed by Chrome child-process activity involving credential paths

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build earlier than 152.0.7977.65
Monitor endpoint telemetry for Chrome accessing sensitive paths that fall outside the expected profile scope
Correlate browser download events with subsequent file-open activity in Chrome and any anomalous reference resolution errors in logs

Monitoring Recommendations

Enable enterprise reporting through the Chrome Browser Cloud Management console to capture version drift and policy state
Ingest endpoint process, file, and download telemetry into a centralized data lake for retrospective hunting against Chrome credential paths
Alert on Chrome executing with command-line arguments that reference files sourced from temporary or untrusted directories

How to Mitigate CVE-2026-79049

Immediate Actions Required

Update Google Chrome Desktop to version 152.0.7977.65 or later on all managed endpoints
Force a browser restart after the update to ensure the patched binaries are loaded
Audit endpoints that had Chrome installed prior to the patch and review recent file-open activity for anomalies

Patch Information

Google released the fix in the Stable channel update announced in the Google Chrome Desktop Update advisory. Users and administrators should install Chrome 152.0.7977.65 or later. Chromium-based browsers should apply the corresponding vendor updates that incorporate the upstream fix.

Workarounds

Restrict opening of files from untrusted sources in Chrome using enterprise policies until the patch is applied
Use application allowlisting to limit which file types Chrome is permitted to process from user-writable locations
Disable or restrict Chrome's password manager where feasible for high-risk user groups until updates are deployed

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed Chrome version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Example enterprise policy fragment to enforce automatic updates (managed_policies.json)
{
  "BrowserSignin": 1,
  "PasswordManagerEnabled": false,
  "DownloadRestrictions": 3
}