CVE-2026-79094: Google Chrome Workers Race Condition Flaw

CVE-2026-79094 Overview

CVE-2026-79094 is a race condition vulnerability in the Workers component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can bypass system access restrictions by serving a crafted HTML page to a targeted user. Google's Chromium project rates the security severity as Medium. The flaw is classified under CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization. Exploitation requires the victim to load attacker-controlled web content, and successful attacks can undermine the browser's process and origin isolation guarantees.

Critical Impact
A remote attacker can bypass Chrome system access restrictions via a crafted HTML page, potentially breaking security boundaries enforced by Workers.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers that embed the vulnerable Workers implementation
Downstream distributions repackaging pre-patch Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79094 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79094

Vulnerability Analysis

The defect resides in Chrome's Workers implementation, which schedules JavaScript execution across background threads such as dedicated, shared, and service workers. Because Workers coordinate lifecycle state and cross-thread messaging with the main renderer, they rely on precise synchronization when enforcing origin and access checks. The race condition allows an attacker-controlled HTML page to interleave operations in a way the browser does not expect. During this narrow window, the security check that gates protected APIs or resources evaluates state that has already changed. The outcome is a bypass of system access restrictions that Chrome would normally enforce on untrusted web content.

Root Cause

The root cause is improper synchronization of shared state between the Workers subsystem and the security enforcement path, matching the pattern described in CWE-362. Two concurrent operations act on the same object without adequate locking or ordering guarantees. An attacker who can trigger both operations from a single page reaches a state the developers did not anticipate.

Attack Vector

Exploitation is remote and requires user interaction only to the extent of visiting a malicious or compromised web page. The attacker delivers HTML and JavaScript that instantiate one or more Workers and drive them into the racy code path. No authentication and no browser plugin is required. The Chromium issue tracker entry #517467117 contains the restricted technical detail, and the fix ships in the Chrome Stable channel update. No public proof-of-concept exploit is currently available, and the EPSS probability is low.

Detection Methods for CVE-2026-79094

Indicators of Compromise

Chrome browser processes reporting versions below 152.0.7977.65 in endpoint telemetry.
Renderer processes spawning unusual numbers of dedicated or shared Workers from a single origin.
Outbound connections from browsers to newly registered or low-reputation domains hosting HTML with heavy Worker instantiation.

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions across managed endpoints and flag any build below 152.0.7977.65.
Correlate browser process telemetry with URL reputation feeds to surface visits to domains delivering suspicious Worker-heavy JavaScript.
Alert on renderer sandbox escapes, unexpected file system access, or IPC anomalies originating from browser child processes.

Monitoring Recommendations

Ingest browser version and process telemetry into a centralized data lake for continuous version drift analysis.
Track post-visit behavior such as newly written files, credential store access, or child process creation initiated from Chrome.
Monitor enterprise browser management policies to confirm automatic updates remain enabled on all endpoints.

How to Mitigate CVE-2026-79094

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update installs so the patched binary loads in all sessions.
Push equivalent updates for Chromium-based browsers such as Microsoft Edge and Brave as their vendors ship rebased releases.

Patch Information

Google addressed CVE-2026-79094 in the Chrome Stable channel release documented in the Google Chrome Stable Update announcement. The fixed version is 152.0.7977.65. Administrators should verify deployment through enterprise policy reporting or the chrome://version page. The corresponding restricted bug report is tracked as Chromium Issue #517467117.

Workarounds

Enforce automatic Chrome updates through enterprise policy so future patches deploy without user action.
Restrict browsing on high-value systems to allow-listed domains until the update is confirmed installed.
Apply site isolation and strict third-party cookie policies to reduce the impact of malicious cross-origin content.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: read the CFBundleShortVersionString from the app bundle
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString