CVE-2026-79065: Google Chrome Web Origin Policy Bypass

CVE-2026-79065 Overview

CVE-2026-79065 is an improper input validation vulnerability [CWE-20] in the Network component of Google Chrome prior to version 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass the web origin policy using a crafted HTML page. Google rated the Chromium security severity as Medium. The flaw undermines the browser's same-origin boundary, one of the core protections that isolates content from different web origins.

Critical Impact
An attacker with control over the renderer process can bypass web origin policy enforcement, exposing cross-origin data to unauthorized access.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers that share the affected Network component
Desktop Chrome distributions across Windows, macOS, and Linux

Discovery Timeline

2026-08-25 - CVE-2026-79065 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79065

Vulnerability Analysis

The vulnerability resides in the Network component of Chrome and stems from improper input validation. When a renderer process is already compromised, the attacker can supply a crafted HTML page that manipulates network-layer handling in a way the browser fails to validate. This validation gap allows the attacker to bypass the Same-Origin Policy (SOP), which normally restricts scripts and resources loaded from one origin from interacting with another.

The attack requires a two-stage exploitation model. The attacker first compromises the renderer process, typically through a separate memory corruption or logic bug. From the compromised renderer, the attacker then leverages CVE-2026-79065 to escape origin restrictions and access data belonging to unrelated web origins.

Root Cause

The root cause is insufficient validation of input processed by the Network component [CWE-20]. Chrome's multi-process architecture relies on the browser process to enforce origin boundaries even when a renderer is untrusted. This bug weakens that enforcement, allowing crafted requests or responses to influence how the browser applies origin checks.

Attack Vector

Exploitation requires prior compromise of the renderer process, then delivery of a crafted HTML page. Successful exploitation lets the attacker read or interact with resources belonging to other web origins. Consequences include theft of authenticated session data, cross-origin content disclosure, and expansion of the browser sandbox breakout impact. The EPSS score at publication was approximately 0.28%, reflecting a low near-term probability of widespread exploitation but not eliminating targeted risk.

No verified public proof-of-concept code is available. For technical specifics, refer to the Chromium Issue #501799770 tracker and the Chrome Stable Update Announcement.

Detection Methods for CVE-2026-79065

Indicators of Compromise

Chrome installations reporting a version string earlier than 152.0.7977.65 in enterprise inventory data.
Unexpected cross-origin network requests originating from renderer processes, especially those preceded by renderer crashes or anomalies.
Browser telemetry showing repeated navigations to attacker-controlled HTML pages combined with unusual outbound requests to sensitive internal origins.

Detection Strategies

Deploy endpoint identification rules that track installed Chrome versions and flag hosts running builds prior to 152.0.7977.65.
Monitor renderer process crashes and unusual child process behavior in Chrome, which can indicate a preceding renderer compromise.
Correlate proxy and DNS logs for unexpected cross-origin data flows originating from user browsers.

Monitoring Recommendations

Ingest browser version inventory data into your SIEM and alert on outdated Chrome builds across managed endpoints.
Track network egress from browser processes for requests to authenticated internal applications that lack normal referrer or origin patterns.
Enable Chrome Enterprise reporting to centralize crash telemetry and extension activity for security review.

How to Mitigate CVE-2026-79065

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Restart Chrome after the update to ensure the patched binaries are loaded, since Chrome does not fully apply updates until relaunch.
Inventory Chromium-based browsers in your environment and confirm each vendor has shipped an equivalent fix.

Patch Information

Google addressed CVE-2026-79065 in Chrome Stable 152.0.7977.65. Details are published in the Chrome Stable Update Announcement. The corresponding Chromium tracker entry is Chromium Issue #501799770. Enterprises using Chrome Browser Cloud Management or group policy should confirm that auto-update channels are enabled and reaching the current Stable build.

Workarounds

No official workaround eliminates the flaw. Prioritize patching to 152.0.7977.65 or later.
Reduce exposure by restricting access to untrusted websites through enterprise browsing policies until patches are fully deployed.
Enforce site isolation and disable unnecessary browser extensions that increase renderer attack surface.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# macOS: confirm the installed Chrome build
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString