CVE-2026-79060 Overview
CVE-2026-79060 is an incorrect authorization vulnerability [CWE-863] in the StorageAccessAPI component of Google Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass web origin policy by serving a crafted HTML page. Google classifies the Chromium security severity as Low, though the CVSS score reflects a higher integrity impact on the isolation model. The flaw undermines same-origin restrictions that separate content between web origins in the browser.
Critical Impact
Attackers who control a compromised renderer process can bypass web origin policy through StorageAccessAPI, breaking site isolation guarantees and enabling cross-origin data access.
Affected Products
- Google Chrome desktop versions prior to 152.0.7977.65
- Chromium-based browsers incorporating the affected StorageAccessAPI implementation
- All supported desktop platforms (Windows, macOS, Linux) running vulnerable Chrome builds
Discovery Timeline
- 2026-08-25 - CVE-2026-79060 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79060
Vulnerability Analysis
The vulnerability resides in Chrome's StorageAccessAPI, the browser interface that governs cross-site storage access requests. Chrome fails to correctly enforce authorization checks when a renderer requests storage access on behalf of a document. An attacker who has already achieved code execution inside a renderer process can issue crafted API calls that the browser treats as authorized. This breaks the web origin policy that isolates cookies, storage, and site data between origins.
The issue is tracked as CWE-863: Incorrect Authorization. The bug requires a prior compromise chain, since a normal web page cannot reach the vulnerable code path directly. When chained with a renderer exploit, however, the flaw expands attacker capability from a single tab into cross-origin data theft.
Root Cause
The root cause is missing or incomplete authorization enforcement inside the StorageAccessAPI handler. The browser process trusts renderer-supplied context when deciding whether to grant storage access, rather than independently validating the origin and user grant state. Because the renderer is untrusted after compromise, this trust boundary violation lets a malicious renderer request access as if it were a different origin.
Attack Vector
Exploitation requires two stages. First, the attacker exploits a separate renderer vulnerability, typically through a malicious or attacker-controlled web page. Second, the attacker uses the compromised renderer to issue crafted StorageAccessAPI requests that the browser authorizes despite violating origin policy. The attacker can then read or manipulate data belonging to other web origins loaded in the browser. See the Chromium Issue Tracker #519254827 for additional detail.
Detection Methods for CVE-2026-79060
Indicators of Compromise
- Chrome browser processes running versions earlier than 152.0.7977.65 on endpoints
- Renderer process crashes or anomalous child process behavior preceding cross-origin data access events
- Unexpected outbound requests carrying session cookies or tokens for origins the user did not directly interact with
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag builds below 152.0.7977.65 for remediation
- Correlate browser telemetry with web proxy logs to identify requests where storage or credentials appear scoped to unexpected origins
- Hunt for renderer exploitation precursors such as JIT spray patterns, sandbox escape attempts, or unusual JavaScript payloads served from low-reputation domains
Monitoring Recommendations
- Deploy EDR telemetry on browser child processes to capture unexpected process spawning or memory anomalies inside chrome.exe renderers
- Monitor DNS and HTTP egress for connections to newly observed or low-reputation domains that host complex JavaScript payloads
- Track browser update compliance through endpoint management tooling and alert on hosts that stall on outdated builds
How to Mitigate CVE-2026-79060
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
- Restart browsers after the update to ensure the patched binaries are loaded into memory
- Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the upstream Chromium fix
Patch Information
Google addressed CVE-2026-79060 in Chrome Stable 152.0.7977.65. Details are available in the Google Chrome Stable Update announcement. Chromium downstream distributors ship the fix through their own release channels; administrators should confirm patched builds in enterprise deployment tooling.
Workarounds
- Enforce automatic Chrome updates through enterprise policy (ChromeCleanupEnabled, AutoUpdateCheckPeriodMinutes) until all endpoints report the fixed version
- Restrict browsing to trusted sites via web filtering while patching is in progress, reducing exposure to renderer exploitation chains
- Disable or restrict third-party storage access where business processes permit, limiting the value of a StorageAccessAPI bypass
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
# Verify installed Chrome version on macOS/Linux endpoints
google-chrome --version
# Example enterprise policy to force update compliance (Windows registry)
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
