CVE-2026-79099: Google Chrome Authorization Bypass Vulnerability

CVE-2026-79099 Overview

CVE-2026-79099 is a missing authorization vulnerability in the Network component of Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to bypass system access restrictions through a crafted HTML page. Google's Chromium security team rated the severity as Medium. The weakness is classified under CWE-862: Missing Authorization.

An attacker can exploit the flaw by luring a user to a malicious web page. Successful exploitation bypasses authorization checks in Chrome's network stack, potentially exposing resources that should be restricted by same-origin or system-level policies.

Critical Impact
A crafted HTML page can bypass authorization controls in Chrome's network stack, enabling access to resources that should be restricted from remote origins.

Affected Products

Google Chrome for Desktop (Windows, macOS, Linux) prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Network component
Embedded applications using affected Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79099 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79099

Vulnerability Analysis

The vulnerability resides in Chrome's Network component, which handles URL loading, request routing, and cross-origin policy enforcement. The component fails to perform an authorization check before granting access to a protected resource path. A remote attacker delivers a crafted HTML page that triggers the unchecked code path.

The result is a bypass of system access restrictions that would normally block untrusted web content from reaching privileged endpoints. Google restricts detailed fix information until a majority of users are patched. Refer to the Chromium Issue Tracker #517608454 once access restrictions are lifted for full technical context.

Root Cause

The root cause is a missing authorization check [CWE-862] in the Chrome Network component. Code that mediates access to a protected resource does not verify whether the requesting context holds the required privilege. This allows web-origin requests to reach code paths intended only for trusted callers.

Attack Vector

Exploitation is remote and requires user interaction. The victim must load or navigate to an attacker-controlled HTML page. Once loaded, the page issues requests that the Network component processes without enforcing the expected authorization boundary. No authentication is required on the attacker's side, and the payload is delivered entirely through standard web content.

Google has not published a proof of concept, and no public exploit is currently available. See the Google Chrome Stable Update for release-level details.

Detection Methods for CVE-2026-79099

Indicators of Compromise

Chrome browser processes running versions prior to 152.0.7977.65 in enterprise inventory
Outbound connections from browser child processes to unexpected internal endpoints following visits to untrusted sites
Anomalous HTML pages containing requests to system or local resources not typical of the user's browsing pattern

Detection Strategies

Inventory installed Chrome versions across the estate and flag any host below 152.0.7977.65 as vulnerable.
Monitor browser process telemetry for renderer or network service activity targeting internal or restricted URIs.
Correlate web proxy logs with endpoint browsing history to identify visits to newly registered or low-reputation domains preceding suspicious network activity.

Monitoring Recommendations

Enforce browser version reporting through enterprise management (Chrome Browser Cloud Management or equivalent MDM).
Alert on Chrome update failures or hosts that remain on outdated builds beyond the patch window.
Log DNS and HTTP telemetry for domains delivering HTML content to Chrome users, and retain for retrospective analysis.

How to Mitigate CVE-2026-79099

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update installs to ensure the patched Network component is loaded.
Verify Chromium-based third-party browsers (Edge, Brave, Opera, Vivaldi) have absorbed the upstream fix.

Patch Information

Google released the fix in the Chrome Stable channel at version 152.0.7977.65. Details are documented in the Google Chrome Stable Update release notes. Chrome typically auto-updates on next launch, but enterprise-managed installations may require an administrator-driven rollout.

Workarounds

No official workaround exists. Patching is the only complete remediation.
Restrict browsing to trusted sites through URL filtering or DNS-layer controls until endpoints are updated.
Disable Chrome or route users to an already-patched browser on hosts that cannot receive the update immediately.

bash

# Verify Chrome version on Linux/macOS
google-chrome --version
# Expected output: Google Chrome 152.0.7977.65 or later

# Force-update Chrome on Windows via command line
"%ProgramFiles%\Google\Chrome\Application\chrome.exe" --check-for-update-interval=1