CVE-2026-79082 Overview
CVE-2026-79082 is an incorrect authorization vulnerability [CWE-863] in the Transactions Platform component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass web origin policy through a crafted HTML page. Chromium project rated the security severity as High.
Critical Impact
Attackers who control a compromised renderer can bypass same-origin protections, exposing cross-origin data and enabling unauthorized transactions across web contexts.
Affected Products
- Google Chrome Desktop versions prior to 152.0.7977.65
- Chromium-based browsers incorporating the vulnerable Transactions Platform component
- All supported desktop operating systems running affected Chrome builds
Discovery Timeline
- 2026-08-25 - CVE-2026-79082 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79082
Vulnerability Analysis
The vulnerability resides in Chrome's Transactions Platform, a browser subsystem that mediates transactional web operations. The component fails to enforce authorization checks consistently across origins. As a result, a renderer process operating outside its expected boundaries can invoke Transactions Platform functions bound to a different web origin. The bug requires a prerequisite renderer compromise, meaning the attacker must first execute code within the sandboxed renderer through a separate exploit or memory-safety flaw.
Once inside the renderer, the attacker delivers a crafted HTML page that exercises the Transactions Platform interface. The missing authorization step permits the request to succeed against resources belonging to unrelated origins. The classification aligns with [CWE-863: Incorrect Authorization], where access control decisions are made but rely on flawed logic. The EPSS probability of 0.242% reflects limited public exploitation signals at the time of publication.
Root Cause
The Transactions Platform performs authorization decisions without correctly validating the requesting origin against the target resource origin. This produces a broken enforcement path where privileged inter-origin operations execute for callers that should be denied. Web origin policy, which normally isolates document contexts, is not consistently applied for this code path.
Attack Vector
Exploitation requires two stages. First, the attacker compromises the renderer process, typically through a separate vulnerability such as a type confusion or use-after-free in the rendering engine. Second, the attacker loads a crafted HTML page that triggers Transactions Platform calls to bypass same-origin enforcement. This chain enables cross-origin data access and unauthorized state changes from within the compromised renderer. See Chromium Issue #524698525 for tracking details.
Detection Methods for CVE-2026-79082
Indicators of Compromise
- Chrome browser processes running versions earlier than 152.0.7977.65 in enterprise inventories
- Anomalous cross-origin requests originating from renderer processes with unexpected transaction patterns
- Renderer process crashes or exceptions preceding suspicious network activity to unrelated origins
Detection Strategies
- Inventory endpoint browsers and flag hosts running Chrome builds below 152.0.7977.65
- Correlate browser telemetry with EDR process events to identify renderer child processes exhibiting privileged behavior
- Inspect HTTP proxy logs for cross-origin request bursts that deviate from user browsing baselines
Monitoring Recommendations
- Track Chrome update compliance through management tooling and enforce minimum version policies
- Monitor for exploit chains that combine renderer memory-safety issues with origin bypass activity
- Review Google Chrome Stable Update release notes for related fixes shipped alongside this patch
How to Mitigate CVE-2026-79082
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later across all managed endpoints
- Restart Chrome after applying the update so the patched binaries load
- Verify update rollout through browser management consoles and endpoint inventory tools
Patch Information
Google addressed the vulnerability in Chrome stable channel version 152.0.7977.65. The fix corrects authorization enforcement in the Transactions Platform so cross-origin requests are properly validated. Deployment details are published in the Google Chrome Stable Update advisory.
Workarounds
- No vendor-supplied workaround exists; patching is the required remediation path
- Restrict browsing to trusted sites until the update is deployed to reduce exposure to renderer exploits
- Enable site isolation and enterprise policies that limit installation of untrusted extensions to shrink the renderer attack surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
