CVE-2026-79066: Google Chrome Site Isolation Bypass Flaw

CVE-2026-79066 Overview

CVE-2026-79066 is an improper input validation vulnerability [CWE-20] in the Navigation component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass site isolation using a crafted HTML page. Google's Chromium project rates the security severity as Medium.

Site isolation is a core Chrome security boundary that separates content from different origins into distinct processes. Bypassing this boundary allows a compromised renderer to access data belonging to other sites, undermining the browser's sandbox model.

Critical Impact
A compromised renderer process can bypass site isolation, enabling cross-origin data access from a crafted HTML page.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Navigation code
Desktop Chrome Stable channel builds released before the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-79066 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79066

Vulnerability Analysis

The vulnerability resides in Chrome's Navigation logic, which processes URL loads and frame transitions across origins. Improper input validation allows a crafted HTML page to influence navigation state in a way that violates site isolation guarantees.

Exploitation requires the attacker to first compromise the renderer process. This is a two-stage attack pattern where a separate renderer bug provides the initial foothold, and CVE-2026-79066 escalates access across the site isolation boundary. The result is unauthorized access to cross-origin resources that the renderer should not reach.

Root Cause

The root cause is improper input validation [CWE-20] within navigation handling. The browser fails to sufficiently validate inputs supplied by the renderer process before applying navigation decisions, allowing state to be manipulated in ways that bypass origin enforcement.

Attack Vector

The attack requires a compromised renderer process as a prerequisite. From that position, the attacker delivers a crafted HTML page that triggers navigation flows Chrome does not validate correctly. Technical specifics are tracked in Chromium Issue Tracker #511736672. See the Google Chrome Stable Update advisory for the release notes.

No public proof-of-concept code has been released. The EPSS score is 0.237% (percentile 14.56), indicating a low probability of exploitation in the near term.

Detection Methods for CVE-2026-79066

Indicators of Compromise

Chrome processes running versions earlier than 152.0.7977.65 on managed endpoints
Renderer process crashes or anomalous child-process spawning preceding cross-origin data access
Unexpected navigation events to sensitive origins from unrelated tabs or frames

Detection Strategies

Inventory installed Chrome versions across the fleet and flag builds below 152.0.7977.65
Monitor browser telemetry for renderer compromise indicators such as sandbox escape attempts or unusual IPC traffic
Correlate web traffic logs for sequences involving crafted HTML pages followed by cross-origin requests

Monitoring Recommendations

Enable Chrome enterprise reporting to centralize crash and extension telemetry
Track endpoint software inventory changes to confirm Chrome auto-update completion
Alert on browser process behavior that deviates from established baselines, including unexpected file access or network destinations

How to Mitigate CVE-2026-79066

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all endpoints
Verify that Chrome auto-update is enabled and functioning on managed devices
Restart browser sessions after update deployment to ensure the patched binary is active

Patch Information

Google addressed CVE-2026-79066 in the Chrome Stable channel release 152.0.7977.65. Details are documented in the Google Chrome Stable Update release notes. Chromium-based browser vendors should incorporate the corresponding upstream fix.

Workarounds

No official workarounds are published; patching is the required remediation
Restrict browsing to trusted sites until updates are applied to reduce exposure to renderer compromise chains
Deploy browser policies that limit high-risk extensions and disable unneeded features to reduce renderer attack surface

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\Software\Google\Update\Clients" /s /f "pv"