CVE-2026-79051: Google Chrome Authorization Bypass Vulnerability

CVE-2026-79051 Overview

CVE-2026-79051 is an incorrect authorization vulnerability in the Loader component of Google Chrome prior to version 152.0.7977.65. A remote attacker can bypass web origin policy by serving a crafted HTML page to a victim. Chromium classifies the security severity as Medium. The flaw maps to CWE-863: Incorrect Authorization and impacts the same-origin protections that isolate untrusted web content.

Critical Impact
Successful exploitation lets an attacker-controlled page read or influence resources across origin boundaries, undermining the browser's fundamental isolation model.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Loader logic
Any deployment channel (Stable, Beta, Dev) that had not received the fixed build

Discovery Timeline

2026-08-25 - CVE-2026-79051 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79051

Vulnerability Analysis

The vulnerability resides in Chrome's Loader, the subsystem responsible for fetching resources and enforcing origin-based access decisions. Incorrect authorization logic allows a crafted HTML page to reach content or capabilities that the web origin policy should have blocked. The result is a same-origin policy bypass triggered purely through remote web content, without user privileges beyond visiting a page.

Because the Loader mediates network requests and their responses, an authorization gap here weakens the boundary between mutually distrusting web origins. Attackers can chain this class of bypass with content injection or credentialed session flows to escalate impact.

Root Cause

The root cause is an CWE-863 authorization check that does not correctly validate the origin context before permitting an action in the Loader. Google's advisory does not disclose the specific code path. Details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation requires a victim to load an attacker-controlled or attacker-influenced HTML page in an unpatched Chrome build. The page issues requests or navigations that the Loader authorizes despite crossing an origin boundary. No authentication or elevated privileges are required on the target system, and the EPSS estimate for near-term exploitation remains low.

See the Chrome Release Update for vendor context on the fixed release.

Detection Methods for CVE-2026-79051

Indicators of Compromise

Browser telemetry showing outbound requests initiated by unexpected origins immediately after loading unfamiliar HTML pages.
Cross-origin responses returning sensitive data (session tokens, user profile fields) to third-party pages in proxy or DLP logs.
Reports from users describing session state, autofill, or authenticated data appearing on untrusted sites.

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any build below 152.0.7977.65.
Correlate web proxy logs with endpoint browser version data to identify vulnerable clients making cross-origin requests to newly registered or low-reputation domains.
Hunt for anomalous Referer and Origin header combinations that suggest same-origin policy circumvention.

Monitoring Recommendations

Enable centralized Chrome enterprise reporting to track version rollout and policy compliance.
Ingest browser and proxy telemetry into a SIEM or data lake and alert on stale Chrome versions communicating with unclassified domains.
Monitor authentication providers for session reuse from unexpected client contexts following user browsing activity.

How to Mitigate CVE-2026-79051

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update to ensure the patched Loader binary is loaded into memory.
Audit Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) for corresponding upstream fixes and apply vendor updates.

Patch Information

Google addressed the flaw in the Stable channel release documented in the Chrome Release Update. Administrators should force an update through enterprise policy or MDM rather than relying on user-initiated relaunches. Technical tracking is maintained in the Chromium Issue Tracker Entry.

Workarounds

Restrict browsing to trusted sites through enterprise URL allowlists until patches are deployed.
Enforce Chrome auto-update policies (ChromeAutoUpdate and UpdateDefault) to prevent version drift.
Isolate high-risk browsing activity in a remote browser or dedicated virtual desktop while patch rollout completes.

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows registry check for enforced auto-update policy
reg query "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault