CVE-2026-79058: Google Chrome Passwords Auth Bypass Flaw

CVE-2026-79058 Overview

CVE-2026-79058 is a missing authorization vulnerability [CWE-862] in the Passwords component of Google Chrome prior to version 152.0.7977.65. A remote attacker who has already compromised the renderer process can spoof user interface elements via a crafted HTML page. The flaw enables convincing UI spoofing attacks that can deceive users into disclosing stored credentials or trusting attacker-controlled content. Google rates the Chromium security severity as Low, while the National Vulnerability Database assigns a higher CVSS score based on the network-reachable impact profile.

Critical Impact
An attacker with a compromised renderer process can spoof browser UI to manipulate user trust decisions and target saved passwords.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers using affected upstream Passwords component
All supported desktop platforms (Windows, macOS, Linux)

Discovery Timeline

2026-08-25 - CVE-2026-79058 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79058

Vulnerability Analysis

The vulnerability resides in the Passwords subsystem of Google Chrome. The Passwords component fails to enforce authorization checks on operations that influence user-facing UI surfaces. An attacker who already controls a renderer process can invoke these operations to render spoofed browser chrome or password-related dialogs. Because the spoofed elements appear to originate from the trusted browser UI, users cannot reliably distinguish them from legitimate Chrome prompts.

The impact chain requires prior renderer compromise, typically achieved by chaining a separate memory corruption or logic bug. Once combined, the attacker can present forged autofill prompts, password manager panels, or origin indicators to harvest credentials or drive social-engineering flows. The EPSS probability sits at 0.232% at the 13.925 percentile, reflecting low observed exploitation activity at publication.

Root Cause

The root cause is a missing authorization check [CWE-862] on privileged Passwords-component operations exposed to the renderer. Chrome's process model assumes the browser process validates sensitive UI actions requested by less-trusted renderers. The affected code path accepts renderer-initiated requests without verifying that the caller is authorized to influence the rendered UI element.

Attack Vector

Exploitation requires the attacker to first compromise a renderer process, then serve a crafted HTML page that triggers the vulnerable code path. The attack is network-reachable and requires no user interaction beyond visiting attacker-controlled or attacker-injected content. See the Chromium Issue Tracker #519242511 and the Google Chrome Desktop Update for vendor references. No public proof-of-concept is available at time of publication.

Detection Methods for CVE-2026-79058

Indicators of Compromise

Chrome browser instances reporting version strings earlier than 152.0.7977.65 after the patch window
Renderer process crashes or anomalous child-process spawns preceding credential-related user activity
Outbound connections from browser processes to newly registered or low-reputation domains hosting crafted HTML payloads

Detection Strategies

Inventory Chrome installations across managed endpoints and flag versions below 152.0.7977.65
Correlate renderer process anomalies with subsequent authentication events to identify credential theft attempts stemming from spoofed UI
Monitor for browser telemetry showing unexpected password autofill prompt frequency or origin mismatches

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake for correlation across renderer, network, and authentication events
Alert on Chrome child-process behavior deviating from established baselines, such as unusual IPC patterns or memory anomalies
Track credential submission events immediately following visits to untrusted origins

How to Mitigate CVE-2026-79058

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force-restart Chrome sessions to ensure the patched binary is loaded rather than cached
Audit enterprise Chrome policies to confirm automatic updates are enabled and not blocked by network egress rules

Patch Information

Google addressed the issue in the Stable channel release documented in the Google Chrome Desktop Update. Administrators should deploy Chrome 152.0.7977.65 or newer. Chromium downstream vendors should track the upstream fix referenced in Chromium Issue Tracker #519242511 and rebuild affected packages.

Workarounds

Disable Chrome's built-in password manager and route credential storage through an enterprise password manager until patching completes
Restrict browsing to allowlisted origins via enterprise policy to reduce exposure to crafted HTML payloads
Enable site isolation and enhanced Safe Browsing to limit renderer compromise prerequisites

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version
# Expected output: Google Chrome 152.0.7977.65 or later

# Windows: query registry for installed Chrome version
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version