CVE-2026-79088: Google Chrome FileSystem Auth Bypass Flaw

CVE-2026-79088 Overview

CVE-2026-79088 is an incorrect authorization vulnerability in the FileSystem component of Google Chrome prior to version 152.0.7977.65. The flaw allows a remote attacker to bypass system access restrictions by convincing a user to visit a crafted HTML page. Google classifies the Chromium security severity as Medium and maps the issue to CWE-863: Incorrect Authorization.

Successful exploitation requires social engineering, meaning the target must interact with attacker-controlled web content. The issue is tracked in Chromium Issue Tracker #496401361 and remediated in the Chrome Stable channel update.

Critical Impact
A crafted HTML page can bypass Chrome FileSystem authorization checks, exposing local file access boundaries to remote attackers who successfully lure users to malicious pages.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable FileSystem code path
Downstream browser distributions that had not yet integrated the Chrome 152 security roll-up

Discovery Timeline

2026-08-25 - CVE-2026-79088 published to the National Vulnerability Database
2026-08-26 - NVD record last modified

Technical Details for CVE-2026-79088

Vulnerability Analysis

The vulnerability resides in Chrome's FileSystem implementation, which mediates web content access to local storage and file resources. Chrome enforces authorization checks before granting a renderer access to FileSystem operations. In vulnerable builds, these checks do not fully validate the origin or user gesture context under specific conditions. A crafted HTML page can therefore reach code paths that should have been gated by user consent or origin isolation.

Because the flaw is an authorization defect rather than a memory-safety bug, exploitation does not deliver arbitrary code execution in the renderer sandbox. Instead, it allows attackers to bypass the boundary Chrome enforces on FileSystem access, undermining a security guarantee that end users and enterprise policies depend on.

Root Cause

The root cause is an incorrect authorization decision inside FileSystem [CWE-863]. The component evaluates access using inputs that an attacker can influence through page structure and user interaction, and it does not consistently confirm that the requested operation is permitted for the invoking origin. See Chromium Issue Tracker #496401361 for upstream tracking.

Attack Vector

Exploitation is remote and requires social engineering. The attacker hosts a crafted HTML page and lures a Chrome user to visit it, typically through phishing, malvertising, or a compromised site. When the victim interacts with the page, the FileSystem authorization check yields the wrong result, and the page performs actions that Chrome's security model should have blocked. No authentication is required on the target, and no additional software must be installed.

No verified public exploit code is available. The vulnerability is described in prose per Google's disclosure; see the Chrome Stable channel update for the vendor advisory.

Detection Methods for CVE-2026-79088

Indicators of Compromise

Chrome browser processes on endpoints reporting version strings below 152.0.7977.65 after the patch release date.
Outbound connections from user endpoints to newly registered or low-reputation domains delivering HTML payloads that request FileSystem API access.
Unexpected read or write activity in user profile directories initiated by Chrome renderer child processes shortly after a browsing session to an untrusted site.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any instance below 152.0.7977.65 as vulnerable.
Correlate web proxy logs with endpoint telemetry to identify users who visited suspicious HTML pages followed by anomalous local file access by chrome.exe or its helper processes.
Alert on browser child processes writing to sensitive paths such as user document folders, credential stores, or configuration directories outside typical download workflows.

Monitoring Recommendations

Monitor Chrome auto-update status and enforce a minimum version policy through enterprise management such as Chrome Browser Cloud Management or group policy.
Ingest browser process telemetry and DNS resolution logs into a centralized analytics platform to support retrospective hunting once new indicators emerge.
Track EPSS movement for CVE-2026-79088 and re-prioritize response if exploit probability shifts materially upward.

How to Mitigate CVE-2026-79088

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update so the patched binaries are loaded; pending updates do not protect running sessions.
Audit Chromium-derived browsers such as Microsoft Edge, Brave, Opera, and Vivaldi for equivalent patch levels aligned with Chromium 152.

Patch Information

Google addressed the issue in the Chrome Stable channel at version 152.0.7977.65. Details are published in the Chrome Releases blog entry, and the upstream bug is tracked at Chromium Issue #496401361. Enterprises using managed Chrome deployments should confirm that the update has propagated through their update rings and that no version pinning is holding endpoints on vulnerable builds.

Workarounds

Deploy security awareness reminders warning users about visiting untrusted links, since exploitation depends on social engineering.
Restrict Chrome's access to sensitive directories using operating system-level access controls where feasible.
Use enterprise browser policies to disable or constrain FileSystem-related APIs on managed endpoints until patching is verified.

bash

# Verify Chrome version on Linux and macOS endpoints
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enforce minimum version through Chrome Enterprise policy (example JSON fragment)
# Place in the Chrome managed policy store
# {
#   "TargetVersionPrefix": "152.0.7977.",
#   "RelaunchNotification": 2,
#   "RelaunchNotificationPeriod": 86400000
# }