CVE-2026-79084: Google Chrome Auth Bypass Vulnerability

CVE-2026-79084 Overview

CVE-2026-79084 is a weak cryptography vulnerability [CWE-326] in the Notifications component of Google Chrome on Windows. Versions prior to 152.0.7977.65 use inadequate encryption strength, allowing a remote attacker who leverages social engineering to bypass the web origin policy through a crafted HTML page. Google's Chromium security team rates the issue as Medium severity. The flaw enables cross-origin abuse of the notification surface, undermining the same-origin guarantees browsers enforce between web contexts.

Critical Impact
Attackers can bypass web origin policy on Windows Chrome installations, enabling cross-origin data or notification manipulation when a user is tricked into visiting a crafted page.

Affected Products

Google Chrome on Windows prior to 152.0.7977.65
Chromium-based components sharing the vulnerable Notifications code path
Downstream browsers built on affected Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79084 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79084

Vulnerability Analysis

The defect resides in how the Notifications subsystem in Chrome for Windows protects data associated with notification objects. Insufficient encryption strength [CWE-326] allows an attacker to bypass the web origin policy, the browser control that prevents one origin from reading or influencing another origin's data. Exploitation requires social engineering: the target must visit or interact with an attacker-controlled HTML page. Successful abuse breaks the isolation between web origins for notification-related state on Windows hosts.

Root Cause

The root cause is the use of a cryptographic primitive or key strength that is not sufficient to protect notification-related material. When encryption strength is inadequate, an attacker can predict, recover, or forge values that the browser treats as origin-bound. The Notifications component then accepts crafted input as authoritative, allowing operations that should be restricted by origin. The Chromium issue tracker entry #502805441 documents the underlying defect.

Attack Vector

The attacker hosts a crafted HTML page and uses social engineering to lure a victim running an affected Chrome build on Windows. Once the page loads, it triggers the vulnerable notification handling logic and produces or submits values that pass origin checks incorrectly. The result is a web origin policy bypass affecting the Notifications surface. No authentication is required, and interaction is limited to the standard act of visiting a page.

No verified proof-of-concept code has been published. See the Chromium Issue Tracker #502805441 and the Google Chrome Release Update for vendor detail.

Detection Methods for CVE-2026-79084

Indicators of Compromise

Chrome browser processes on Windows running versions earlier than 152.0.7977.65 after the patch release date
Outbound connections from browser processes to newly registered or low-reputation domains delivering HTML that requests notification permissions
Unexpected notification permission grants or notification API activity originating from sites the user did not intentionally trust

Detection Strategies

Inventory Chrome installations across the Windows fleet and flag any build below 152.0.7977.65 for remediation tracking
Monitor endpoint telemetry for chrome.exe child processes and network activity tied to phishing or social engineering campaigns referencing browser notifications
Correlate web proxy logs with browser version telemetry to identify vulnerable clients visiting untrusted HTML content

Monitoring Recommendations

Alert on Chrome version drift where managed endpoints remain on pre-patch builds beyond a defined SLA
Log and review notification permission changes through browser management policies where available
Track user reports of unexpected browser notifications and pivot on the originating URL for further investigation

How to Mitigate CVE-2026-79084

Immediate Actions Required

Update Google Chrome on Windows to version 152.0.7977.65 or later across all managed and unmanaged endpoints
Force-restart Chrome after deployment so the patched binary is loaded in place of any running vulnerable process
Reinforce user awareness that notification prompts on unfamiliar sites should be denied, since exploitation requires social engineering

Patch Information

Google addressed the issue in the Chrome Stable channel update announced in the Google Chrome Release Update. Upgrade to 152.0.7977.65 or later on Windows. Chromium-derived browsers should pick up the corresponding upstream fix; verify each vendor's advisory before considering deployments complete.

Workarounds

Disable web notifications through enterprise browser policy until patching is complete, using the DefaultNotificationsSetting Chrome policy set to block
Restrict notification permissions to an explicit allowlist of trusted origins via managed policy
Block access to untrusted or newly registered domains at the web proxy to reduce exposure to crafted HTML pages

bash

# Example Chrome Enterprise policy (Windows registry) to block notifications by default
# HKLM\Software\Policies\Google\Chrome
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultNotificationsSetting /t REG_DWORD /d 2 /f

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv