CVE-2026-79068: Google Chrome StreamsAPI Auth Bypass Flaw

CVE-2026-79068 Overview

CVE-2026-79068 is an improper resource exposure vulnerability in the Streams API of Google Chrome prior to version 152.0.7977.65. A remote attacker can leverage a crafted HTML page to potentially bypass the web origin policy and reach a privileged page context. Google classifies the Chromium security severity as Medium. The flaw is tracked under CWE-668: Exposure of Resource to Wrong Sphere and was addressed in the Chrome Stable channel desktop update.

Critical Impact
Successful exploitation allows a remote attacker to cross the web origin boundary from an attacker-controlled page into a privileged Chrome page, expanding the impact of otherwise sandboxed web content.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers that ship the vulnerable Streams API implementation
All desktop platforms (Windows, macOS, Linux) receiving the Chrome Stable channel

Discovery Timeline

2026-08-25 - CVE-2026-79068 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79068

Vulnerability Analysis

The vulnerability resides in the Streams API implementation used by Google Chrome to manage readable, writable, and transform streams for web content. The Streams API exposes JavaScript objects that can move data across execution contexts. When the API fails to correctly scope those resources, an attacker-controlled origin can obtain a handle that references a privileged Chrome page. Privileged pages in Chrome, such as internal chrome:// URLs or WebUI surfaces, run with elevated capabilities compared to standard web origins. Bridging a normal web origin to such a page violates the same-origin policy that isolates renderer content.

Root Cause

The root cause is improper resource exposure [CWE-668] within the Streams API. A stream object or its underlying source is made available across a security boundary that should have isolated it. Because origin checks are not consistently enforced on the exposed stream resource, script running in a low-privilege origin can interact with data or interfaces intended only for a higher-privilege sphere.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The page hosts JavaScript that instantiates or manipulates Streams API objects to obtain a reference that crosses the origin boundary into a privileged page. No additional privileges or authentication are needed on the target system. User interaction is limited to loading the malicious page, which an attacker can deliver through phishing, malvertising, or a compromised website. See the Chromium Issue Tracker #520516462 for developer-facing details when it becomes public.

Detection Methods for CVE-2026-79068

Indicators of Compromise

Chrome browser processes on endpoints reporting a version string below 152.0.7977.65 in installed software inventories.
Renderer process navigations from untrusted origins that reference or attempt to open chrome:// URLs shortly after loading external HTML.
Web proxy or DNS logs showing user navigation to unfamiliar domains immediately preceding anomalous Chrome behavior.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 152.0.7977.65.
Monitor browser telemetry for renderer crashes or unexpected transitions between web content and WebUI pages.
Correlate email and web gateway alerts on suspicious HTML attachments or links with subsequent browser activity on the same host.

Monitoring Recommendations

Ingest endpoint browser version data into a centralized log or SIEM platform for continuous coverage reporting.
Alert on Chrome update failures or hosts that remain on outdated builds beyond a defined patch window.
Track outbound network connections from renderer processes to identify anomalous data egress after visiting untrusted pages.

How to Mitigate CVE-2026-79068

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Force-restart Chrome after the update so the patched binaries load into active browser sessions.
Verify enterprise policy channels are pushing the Stable channel update and audit any hosts pinned to older builds.

Patch Information

Google addressed CVE-2026-79068 in the Chrome Stable channel desktop release that ships version 152.0.7977.65. Full release details are in the Google Chrome Desktop Update advisory. Chromium-based browsers should pick up the equivalent upstream fix; administrators should confirm their vendor has rebased on the patched Chromium milestone.

Workarounds

Restrict user browsing to trusted sites through web proxy allow-listing until patch deployment completes.
Deploy Chrome enterprise policies that disable access to sensitive chrome:// pages where operationally acceptable.
Increase user awareness of phishing links that could deliver a crafted HTML exploitation page.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows PowerShell: query installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Expected output: 152.0.7977.65 or higher