CVE-2026-79093: Google Chrome Paint Auth Bypass Vulnerability

CVE-2026-79093 Overview

CVE-2026-79093 is an incorrect authorization vulnerability [CWE-863] in the Paint component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65 and allows a remote attacker to potentially bypass the web origin policy through a crafted HTML page. Google's Chromium security team rated the underlying issue as High severity. Successful exploitation undermines the same-origin boundary that separates content from different web origins in the browser.

Critical Impact
A remote attacker who lures a user to a crafted HTML page can bypass web origin protections in Chrome's Paint component, exposing cross-origin content or interactions to attacker-controlled code.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the affected Paint component
Downstream builds that had not yet integrated the Chromium 152 stable update

Discovery Timeline

2026-08-25 - CVE-2026-79093 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79093

Vulnerability Analysis

The vulnerability resides in Chrome's Paint subsystem, which renders visual content within the browser's compositor pipeline. Chrome enforces the web origin policy so that scripts and resources loaded from one origin cannot read or manipulate content belonging to another. In the affected code path, the Paint component performs an authorization check that does not correctly evaluate the requesting origin's rights against the target resource. An attacker who controls an HTML page can invoke the affected path and coerce the browser into treating cross-origin content as accessible.

The issue is classified under [CWE-863: Incorrect Authorization]. According to the Exploit Prediction Scoring System data set of 2026-08-27, the probability of exploitation activity is low relative to other public CVEs.

Root Cause

The root cause is an authorization decision inside the Paint component that fails to consistently apply origin checks. The affected code trusts inputs or state that an attacker can influence from a crafted page, and it grants access to painted content or side-effects that should remain isolated by origin. See the Chromium Issue Tracker entry #523095011 for the upstream tracking record.

Attack Vector

Exploitation requires a user to visit an attacker-controlled or compromised web page in a vulnerable Chrome build. The crafted page issues rendering operations that reach the Paint code path and abuses the flawed authorization decision to interact with content from a different origin. No local access or elevated privileges are required. The attack is network-reachable and depends on user interaction limited to loading the malicious page.

No public proof-of-concept exploit code has been released. Technical details are described in prose based on the vendor advisory and the Google Chrome Stable Channel update.

Detection Methods for CVE-2026-79093

Indicators of Compromise

Chrome browser processes reporting a version string below 152.0.7977.65 in enterprise inventory data
Outbound web requests from user endpoints to suspicious HTML pages that trigger unusual cross-origin rendering behavior
Browser telemetry showing repeated navigation to unknown domains immediately followed by cross-origin resource loads

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any host running a build earlier than 152.0.7977.65.
Correlate proxy and DNS logs with browser process telemetry to identify users visiting newly registered or low-reputation domains delivering HTML payloads.
Monitor for anomalous renderer process behavior, such as unexpected access patterns to cached cross-origin resources on hosts running vulnerable Chrome builds.

Monitoring Recommendations

Ingest endpoint browser inventory and process telemetry into a centralized data lake for version compliance queries.
Track Chrome update rollout progress by comparing observed versions against the fixed baseline 152.0.7977.65.
Alert on execution of Chrome binaries from non-standard paths or with command-line flags that disable site isolation or web security.

How to Mitigate CVE-2026-79093

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Force a browser relaunch after the update so the patched Paint component is loaded into all renderer processes.
Verify downstream Chromium-based browsers have integrated the corresponding upstream fix before considering them remediated.

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Channel update announcement. The fix is included in Chrome 152.0.7977.65 for Desktop. Administrators should confirm auto-update is functioning and validate the deployed version through enterprise management tooling. The upstream code change is tracked in Chromium Issue #523095011.

Workarounds

Restrict browsing on unpatched hosts to trusted internal applications until the Chrome update is deployed.
Enforce site isolation and disable any policies that weaken origin separation, such as --disable-web-security, through enterprise browser policy.
Use web filtering to block access to unknown or low-reputation domains that could host crafted HTML pages targeting the Paint component.

bash

# Configuration example: verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# On macOS, check the installed Chrome version
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# On Linux
google-chrome --version