CVE-2026-79053 Overview
CVE-2026-79053 is a missing authorization vulnerability [CWE-862] in the Lighthouse component of Google Chrome prior to version 152.0.7977.65. The flaw allows a remote attacker who has already compromised the renderer process to bypass site isolation through a crafted HTML page combined with user interaction. Successful exploitation requires social engineering to convince the victim to perform specific actions in the browser. Google assigned this issue a Chromium security severity of Medium.
Critical Impact
An attacker with a compromised renderer can escape site isolation boundaries and access cross-origin content, undermining a core Chrome security guarantee.
Affected Products
- Google Chrome desktop versions prior to 152.0.7977.65
- Chromium-based browsers embedding the vulnerable Lighthouse component
- Chrome installations on Windows, macOS, and Linux running affected builds
Discovery Timeline
- 2026-08-25 - CVE-2026-79053 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79053
Vulnerability Analysis
The vulnerability resides in Lighthouse, the auditing and performance analysis component integrated into Chrome. Lighthouse fails to enforce authorization checks on operations that should remain constrained by Chrome's site isolation model. Site isolation is designed to keep content from different origins in separate renderer processes, limiting the blast radius of a renderer compromise.
Because Lighthouse skips required authorization validation, an attacker who has already achieved code execution in a renderer process can invoke Lighthouse functionality to reach data or execution contexts outside that renderer's origin. Exploitation is not fully remote on its own. The attacker must first compromise the renderer through a separate flaw and then use social engineering to trigger the Lighthouse interaction from a crafted HTML page.
Root Cause
The root cause is a missing authorization check [CWE-862] on privileged Lighthouse operations. The affected code path does not verify that the calling context is entitled to cross the site isolation boundary before performing the requested action, violating the least-privilege model that Chrome's process architecture depends on.
Attack Vector
Exploitation requires three conditions: a pre-existing renderer process compromise, a crafted HTML page delivered to the victim, and user interaction driven by social engineering. Once the victim performs the targeted action, the attacker uses the Lighthouse code path to bypass site isolation and reach content or capabilities belonging to a different origin. Details of the specific interaction pattern are restricted in the Chromium tracker until broader patch adoption is reached, according to the Chromium Issue Tracker Entry.
Detection Methods for CVE-2026-79053
Indicators of Compromise
- Chrome browser processes running versions earlier than 152.0.7977.65 in enterprise inventory scans
- Unexpected invocation of Lighthouse auditing APIs from web content outside developer tooling contexts
- Renderer process crashes or anomalous cross-origin data access preceded by Lighthouse activity
Detection Strategies
- Inventory installed Chrome versions across endpoints and flag any build lower than 152.0.7977.65
- Correlate browser telemetry with phishing or social engineering indicators, since exploitation requires user interaction on an attacker-controlled page
- Hunt for chained activity where a renderer exploit precedes cross-origin content access from the same browser session
Monitoring Recommendations
- Enable browser telemetry forwarding to a central data lake for version and process monitoring
- Alert on Chrome installations that fail to auto-update within the enterprise patch window
- Monitor web proxy logs for user visits to unfamiliar domains hosting HTML that invokes performance auditing behavior
How to Mitigate CVE-2026-79053
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
- Force a browser restart after the update so the patched binary is loaded into memory
- Verify Chromium-based browsers such as Edge, Brave, and Opera have absorbed the upstream fix before considering the environment remediated
Patch Information
Google released the fix in the Chrome Stable channel at version 152.0.7977.65. Details are published in the Google Chrome Stable Update advisory. The fix restores authorization checks in the affected Lighthouse code path so that cross-origin operations are rejected when the caller lacks the required privileges.
Workarounds
- Enforce Chrome auto-update policies through group policy or MDM to eliminate manual patch drift
- Deliver user awareness guidance covering social engineering attempts that request specific browser interactions
- Restrict installation of untrusted browser extensions that could aid renderer compromise as a precursor to this flaw
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
