CVE-2026-79050: Google Chrome Auth Bypass Vulnerability

CVE-2026-79050 Overview

CVE-2026-79050 is an incorrect authorization vulnerability [CWE-863] in the Network component of Google Chrome. Versions prior to 152.0.7977.65 are affected. A remote attacker can bypass system access restrictions by serving a crafted HTML page to a targeted user. Chromium's security team rated the issue Medium severity.

The flaw resides in Chrome's Network stack, which handles resource loading and enforces cross-origin and system-level access controls. Successful exploitation enables an attacker-controlled site to reach resources or perform actions that should be blocked by browser security policy.

Critical Impact
A remote attacker can bypass system access restrictions in Chrome's Network component through a crafted HTML page, undermining browser-enforced access controls.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers embedding vulnerable Network code prior to the fixed version
Downstream distributions that ship Chromium without the corresponding patch

Discovery Timeline

2026-08-25 - CVE-2026-79050 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79050

Vulnerability Analysis

The vulnerability is classified as Incorrect Authorization [CWE-863] in the Chrome Network component. The Network module performs authorization checks when a page requests resources, initiates cross-origin traffic, or interacts with system-level endpoints. In vulnerable builds, one of these checks does not correctly validate the requesting context, allowing a request that should be denied to proceed.

Because the defect sits in browser code shared across all sites, any web page loaded by the user can attempt exploitation. Google's advisory characterizes the outcome as a bypass of system access restrictions, meaning the attacker gains reach that browser policy is designed to prevent. The EPSS model estimates a low near-term exploitation probability, but the trivial delivery vector raises real-world risk.

Root Cause

The root cause is an authorization check in Chrome's Network stack that fails to correctly evaluate whether a given request is permitted. Google has not published the specific code path. See Chromium Issue #517364411 for restricted technical details once access is granted.

Attack Vector

Exploitation requires the victim to load attacker-controlled content in a vulnerable Chrome build. The attacker hosts a crafted HTML page and directs the target through phishing, malvertising, or a compromised site. When the page renders, its embedded logic triggers the Network component to issue requests that bypass the intended access restriction. No local access or elevated privileges are required.

Refer to the Google Chrome Stable Update for the vendor's summary of fixed issues in this release.

Detection Methods for CVE-2026-79050

Indicators of Compromise

Chrome browser processes on endpoints reporting versions earlier than 152.0.7977.65
Outbound HTTPS connections from Chrome to newly registered or low-reputation domains immediately followed by anomalous local resource access
Renderer processes issuing network requests that resolve to internal, loopback, or link-local addresses without corresponding user navigation

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag hosts below 152.0.7977.65.
Correlate browser telemetry with proxy or DNS logs to identify pages triggering unexpected cross-origin or system-scoped requests.
Alert on renderer child processes spawning or accessing resources that fall outside typical browsing patterns.

Monitoring Recommendations

Ingest browser process, network, and DNS telemetry into a central analytics platform for correlation across sessions.
Monitor for user reports of unexpected redirects, popups, or downloads following visits to unfamiliar sites.
Track patch compliance metrics for Chrome and Chromium-based browsers as a recurring SOC KPI.

How to Mitigate CVE-2026-79050

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update completes to ensure the patched Network component is loaded.
Verify Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi have applied the corresponding upstream fix.

Patch Information

Google released the fix in the Stable channel update at version 152.0.7977.65. Deployment details and the full list of addressed issues are available in the Google Chrome Stable Update. Enterprise administrators should push the update through their standard Chrome Enterprise or MDM channels.

Workarounds

Restrict browsing to trusted sites using enterprise URL allow-lists until patch deployment completes.
Enforce Chrome auto-update policies through group policy or MDM to prevent version drift.
Apply web filtering and DNS security controls to block known malicious hosting infrastructure that could deliver exploit pages.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Chrome Enterprise policy to enforce auto-updates (Windows registry example)
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f