CVE-2026-79077 Overview
CVE-2026-79077 is an incorrect authorization vulnerability [CWE-863] in the WebProtect component of Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to bypass system access restrictions using a crafted HTML page. Chromium security triage rated the severity as Low.
An attacker exploits the flaw by hosting or delivering malicious HTML content that a Chrome user visits. Successful exploitation lets the page circumvent restrictions that WebProtect is designed to enforce, expanding what web content can access within the browser boundary.
Critical Impact
A crafted HTML page can bypass Chrome WebProtect access restrictions, weakening browser-enforced security boundaries against remote web content.
Affected Products
- Google Chrome (Desktop) versions prior to 152.0.7977.65
- Chromium-based components using the WebProtect authorization logic
- Downstream Chromium browsers that inherit the affected code before rebasing on the patched release
Discovery Timeline
- 2026-08-25 - CVE-2026-79077 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79077
Vulnerability Analysis
The issue resides in the WebProtect subsystem of Google Chrome. WebProtect enforces access-control decisions for web-originated content. The defect is a [CWE-863] incorrect authorization: the component reaches an allow decision in a code path that should have been denied. The consequence is a bypass of system access restrictions triggered by web content the user renders.
The EPSS score of 0.188% indicates low predicted exploitation activity in the near term. The bug requires no prior authentication and no local access. A remote attacker only needs the target user to load attacker-controlled HTML. That characteristic makes drive-by delivery and phishing plausible vectors even though Chromium triage classified severity as Low.
Google addressed the flaw in the stable channel update that ships Chrome 152.0.7977.65. Details of the affected function are restricted in the Chromium Issue Tracker #501416859 pending broad user rollout.
Root Cause
The root cause is an authorization check in WebProtect that returns the wrong decision for specific inputs. The component grants access where policy intends to deny it. Crafted HTML markup steers execution into the vulnerable check.
Attack Vector
Exploitation is remote and requires user interaction limited to visiting a page. The attacker hosts a crafted HTML document, delivers it through a link, ad network, or compromised site, and lets the browser process the payload. No further privileges are required on the target host.
No verified public proof-of-concept code is available. Consult the Google Chrome Stable Update advisory for the vendor's technical framing.
Detection Methods for CVE-2026-79077
Indicators of Compromise
- Chrome browser instances reporting a version string lower than 152.0.7977.65 in endpoint inventory data
- Outbound connections from Chrome to newly registered or low-reputation domains serving HTML with unusual embedded object, iframe, or protocol handler constructs
- Child processes or file writes spawned by chrome.exe shortly after loading an untrusted page, indicating a possible restriction bypass
Detection Strategies
- Inventory Chrome versions across managed endpoints and flag hosts below the patched build
- Correlate browser process telemetry with unexpected access to protected resources, such as local files or restricted URL schemes, immediately after web navigation events
- Monitor DNS and web proxy logs for known malicious hosts identified in threat intelligence feeds referencing Chromium exploitation attempts
Monitoring Recommendations
- Track Chrome auto-update status per endpoint and alert on stalled or disabled update channels
- Ingest browser and endpoint process telemetry into a central data lake for cross-source correlation of navigation and post-navigation activity
- Review Chromium Issue Tracker updates on issue 501416859 for additional technical detail once access restrictions are lifted
How to Mitigate CVE-2026-79077
Immediate Actions Required
- Update Google Chrome to 152.0.7977.65 or later on all managed endpoints
- Force a browser restart to ensure the patched binary is loaded into memory
- Verify that Chrome auto-update is enabled and reachable through corporate network egress policies
Patch Information
Google released the fix in the Chrome stable channel build 152.0.7977.65. Refer to the Google Chrome Stable Update advisory for release notes and to the Chromium Issue Tracker #501416859 for the tracked defect. Downstream Chromium-based browsers should apply their vendor's corresponding update.
Workarounds
- Restrict browsing to trusted sites through enterprise web proxy or URL filtering policies until the patch is deployed
- Apply Chrome enterprise policies to disable unnecessary web platform features that broaden attack surface for crafted HTML content
- Isolate high-risk browsing in a hardened or ephemeral browser profile for users who cannot immediately update
# Verify installed Chrome version on Windows and Linux endpoints
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
# Linux
google-chrome --version
# Expected: 152.0.7977.65 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
