CVE-2026-79090: Google Chrome Privilege Escalation Flaw

CVE-2026-79090 Overview

CVE-2026-79090 is an improper privilege management vulnerability [CWE-269] in the Actor component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can leverage social engineering with a crafted HTML page to bypass system access restrictions. Google's Chromium security team rated this issue as Low severity, though the National Vulnerability Database assigns it a higher CVSS base score due to network exploitability and lack of required privileges.

The flaw impacts desktop installations of Chrome on all supported platforms until users upgrade to the fixed stable channel build.

Critical Impact
A crafted web page can trick users into actions that bypass Chrome's access control boundaries, exposing the browser and host to unauthorized operations.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers that inherit the Actor component from upstream builds prior to the fix
All Chrome-supported desktop operating systems (Windows, macOS, Linux)

Discovery Timeline

2026-08-25 - CVE-2026-79090 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79090

Vulnerability Analysis

The vulnerability resides in Chrome's Actor component, which handles automated or agentic browser actions. Improper privilege management allows the component to perform operations outside the trust boundary intended for untrusted web content. When a user visits a malicious page and is manipulated through social engineering into interacting with it, the Actor executes actions with privileges that should be restricted.

This weakness maps to CWE-269: Improper Privilege Management. The result is a bypass of system access restrictions enforced by the browser sandbox and user-consent model.

Root Cause

The root cause is inadequate privilege separation between the Actor and the untrusted renderer context. The Actor accepts action requests without sufficiently validating that the requesting origin is authorized to perform privileged operations. Additional detail is available in Chromium Issue #517673944.

Attack Vector

Exploitation requires a remote attacker to host a crafted HTML page and lure a victim to visit it. Social engineering drives the victim to perform an interaction that the Actor interprets as authorized. Once triggered, the attacker gains the ability to bypass access restrictions enforced by Chrome. No authentication is required, and the attack originates over the network.

No public proof-of-concept code has been released. Refer to the Google Chrome Desktop Update advisory for vendor context.

Detection Methods for CVE-2026-79090

Indicators of Compromise

Chrome browser processes on endpoints reporting version strings earlier than 152.0.7977.65
Unexpected child processes or file writes spawned from chrome.exe shortly after user navigation to unknown domains
Browser telemetry showing Actor-driven actions originating from external, low-reputation origins

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds prior to 152.0.7977.65
Monitor endpoint process trees for anomalous behavior originating from the browser process following web navigation events
Correlate DNS and proxy logs with browser process activity to identify visits to newly registered or low-reputation domains that precede suspicious host activity

Monitoring Recommendations

Enable browser update compliance reporting through enterprise management consoles
Ingest endpoint process, network, and browser telemetry into a centralized data lake with OCSF normalization to support cross-source correlation
Alert on Chrome renderer or utility processes writing to autostart, scheduled task, or credential store locations

How to Mitigate CVE-2026-79090

Immediate Actions Required

Update Google Chrome Desktop to version 152.0.7977.65 or later on all endpoints
Force restart of Chrome after update deployment to ensure the fixed binary is loaded
Audit enterprise policy to confirm automatic updates are enabled and not blocked by GPO or MDM settings

Patch Information

Google released the fix in the Chrome Stable channel build 152.0.7977.65. See the Google Chrome Stable Channel Update for release details. Chromium-based browsers should apply upstream fixes as they become available from their respective vendors.

Workarounds

Restrict user browsing to trusted domains using web filtering or DNS-based reputation controls until patching completes
Disable or restrict Chrome experimental features and agentic Actor functionality via enterprise policy where supported
Educate users about social engineering lures that request unusual page interactions or confirmation prompts

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify Chrome version on Linux endpoints
google-chrome --version