CVE-2026-79070: Google Chrome Auth Bypass Vulnerability

CVE-2026-79070 Overview

CVE-2026-79070 is an incorrect reference resolution vulnerability in the Cache component of Google Chrome. The flaw affects versions prior to 152.0.7977.65 and allows a remote attacker to bypass the web origin policy through a crafted HTML page. Chromium engineers classified the security severity as Medium. The underlying weakness maps to CWE-706: Use of Incorrectly-Resolved Name or Reference. Exploitation requires a victim to load attacker-controlled web content, after which same-origin protections in the browser cache can be circumvented.

Critical Impact
An attacker can bypass the browser's web origin policy, potentially reading or influencing cached resources that should remain isolated between origins.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers sharing the affected Cache implementation
Desktop platforms served by the Chrome Stable channel

Discovery Timeline

2026-08-25 - CVE-2026-79070 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79070

Vulnerability Analysis

The vulnerability resides in Chrome's Cache subsystem, which stores network responses for reuse across page loads. Incorrect reference resolution occurs when the cache resolves a stored entry to a resource that does not match the requesting origin's security context. A crafted HTML page can trigger this resolution path and receive data intended for a different web origin.

Because the flaw operates at the cache layer, exploitation does not require memory corruption or code execution primitives. The attacker instead abuses logic that maps identifiers to cached objects, breaking the isolation guarantees the browser enforces between websites.

Root Cause

The root cause is a name or reference resolution error [CWE-706] inside the Cache component. Chromium's cache keys and lookups did not correctly bind entries to the originating security principal in every code path. As a result, a lookup that should have returned an origin-scoped cache entry instead resolved to content associated with another origin, breaking the same-origin policy contract.

Attack Vector

Exploitation is remote and requires user interaction limited to visiting a malicious page. An attacker hosts a crafted HTML document that issues cache-populating and cache-reading operations designed to trigger the faulty resolution. When the victim's browser processes the page, the cache returns cross-origin data or accepts writes that influence other origins. Technical specifics are tracked in the Chromium Issue Tracker #518062961 and the Google Chrome Stable Update.

No public proof-of-concept, exploit database entry, or in-the-wild exploitation has been reported. The EPSS probability is 0.202% at the 10.03 percentile as of 2026-08-27.

Detection Methods for CVE-2026-79070

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 in enterprise inventories
Outbound connections from browsers to newly registered or low-reputation domains hosting HTML payloads that manipulate cache APIs
Unusual cross-origin data appearing in cached resources or in application logs that receive user-submitted content

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65 for remediation tracking.
Correlate browser telemetry with web proxy logs to identify sessions loading HTML pages that heavily exercise the Cache and CacheStorage APIs from untrusted origins.
Review web application access logs for anomalous requests indicating that content from one origin was served in the context of another.

Monitoring Recommendations

Ingest browser and proxy telemetry into a central analytics platform to baseline normal cache and cross-origin behavior.
Alert on Chrome installations that fail to update to the patched Stable channel within the organization's defined SLA.
Track advisories published on the Chrome Releases blog to correlate subsequent related issues with existing telemetry.

How to Mitigate CVE-2026-79070

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all desktop platforms.
Restart browser instances after the update so the patched Cache component is loaded into every renderer.
Verify that managed browser update policies are enforced and not suppressed by group policy or MDM configuration.

Patch Information

Google fixed the issue in the Chrome Stable channel release documented in the Stable Channel Update for Desktop. Administrators should deploy 152.0.7977.65 or a newer build. Downstream Chromium-based browsers should be updated once their vendors integrate the corresponding fix referenced in Chromium Issue Tracker #518062961.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patching completes.
Disable or clear site data and cached content for high-risk users who cannot immediately update.
Deploy browser management policies that force automatic updates and prevent version pinning to vulnerable builds.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: check version via registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enforce automatic updates via Chrome Enterprise policy (JSON)
# /etc/opt/chrome/policies/managed/update_policy.json
{
  "UpdateDefault": 1,
  "AutoUpdateCheckPeriodMinutes": 60
}