CVE-2026-79087: Google Chrome Tabs Auth Bypass Vulnerability

CVE-2026-79087 Overview

CVE-2026-79087 is an injection vulnerability in the Chrome Tabs component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can bypass system access restrictions by serving a crafted HTML page to a targeted user. Chromium classifies the security severity as Medium. The weakness maps to [CWE-74], improper neutralization of special elements in output used by a downstream component.

Critical Impact
A crafted web page can leverage the Chrome Tabs surface to circumvent system access restrictions, expanding the browser's exposure beyond intended sandbox boundaries.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Chrome Tabs code path
Google Chrome Stable channel builds released before the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-79087 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79087

Vulnerability Analysis

The vulnerability resides in the Chrome Tabs component, which manages tab lifecycle, navigation, and extension APIs interacting with tab state. An injection weakness in this component allows attacker-controlled input from a crafted HTML page to influence downstream logic that enforces system access restrictions. The result is a bypass of controls that normally isolate web content from privileged browser surfaces. Chromium tracks the underlying issue in Chromium Issue Tracker #504226770.

Root Cause

The root cause is improper neutralization of special elements passed through the Chrome Tabs interface [CWE-74]. Untrusted content from a web page reaches a code path that trusts input structure, letting an attacker alter the semantics of the downstream operation. This class of flaw commonly arises when data crosses a privilege boundary without contextual encoding or validation.

Attack Vector

Exploitation requires a victim to visit or be redirected to a crafted HTML page. No authentication is needed, and the attack is delivered over the network through standard web content. The current EPSS probability for exploitation is 0.38% at the 30.854 percentile as of 2026-08-27. Public exploit code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics beyond the vendor advisory remain restricted while users update, per Chromium's standard disclosure practice. See the Google Chrome Stable Update for release notes.

Detection Methods for CVE-2026-79087

Indicators of Compromise

Chrome browser processes on endpoints reporting a version string below 152.0.7977.65 after the patch release date.
Outbound connections from browser processes to newly registered or low-reputation domains serving HTML content immediately preceded by unexpected local privilege or file access activity.
Unusual child process creation or file writes originating from chrome.exe following a browsing session on an untrusted site.

Detection Strategies

Inventory installed Chrome versions across the fleet using endpoint telemetry and flag hosts still running builds prior to 152.0.7977.65.
Correlate browser navigation events with subsequent process, file, and registry activity to surface access-restriction bypass patterns.
Monitor extension and tab API usage for anomalous invocations that do not align with baseline user behavior.

Monitoring Recommendations

Ingest browser process telemetry and web proxy logs into a centralized analytics platform for retroactive hunting.
Alert on Chrome installations that fail to update within the organization's standard patch window.
Track threat intelligence feeds for emerging proof-of-concept code referencing Chromium Issue Tracker #504226770.

How to Mitigate CVE-2026-79087

Immediate Actions Required

Update Google Chrome on all desktop endpoints to version 152.0.7977.65 or later immediately.
Force a browser relaunch after update deployment to ensure the patched binary is loaded in memory.
Verify that Chromium-based derivative browsers in the environment have absorbed the upstream fix before considering the issue closed.

Patch Information

Google released the fix in the Chrome Stable channel update documented at the Google Chrome Stable Update advisory. Administrators should confirm rollout completion through enterprise management channels such as Chrome Browser Cloud Management or configuration policy reporting.

Workarounds

Restrict browsing to trusted destinations using enterprise web filtering or DNS-layer controls until patching completes.
Enable Chrome's Enhanced Safe Browsing to add heuristic checks on crafted or low-reputation pages.
Reduce attack surface by disabling unnecessary extensions that interact with the Chrome Tabs API.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux endpoints
google-chrome --version