CVE-2026-79103: Google Chrome Speech Auth Bypass Vulnerability

CVE-2026-79103 Overview

CVE-2026-79103 is an incorrect reference resolution vulnerability in the Speech component of Google Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass Chrome's site isolation boundary using a crafted HTML page. Chromium rates the security severity as Medium. The flaw is tracked under CWE-706: Use of Incorrectly-Resolved Name or Reference and requires prior renderer compromise as a precondition, making it a sandbox-escape building block rather than a direct entry point.

Critical Impact
An attacker with renderer-process control can escape site isolation and access cross-origin content, breaking a core browser security boundary.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Speech component
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-08-25 - CVE-2026-79103 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79103

Vulnerability Analysis

The vulnerability resides in Chrome's Speech implementation, which handles Web Speech API functionality for text-to-speech and speech recognition. Incorrect reference resolution occurs when the component resolves an identifier or object reference to the wrong entity across process or origin boundaries. In a browser using site isolation, each site should be confined to its own renderer process with strict cross-origin controls. When Speech resolves a reference incorrectly, it can associate data or capabilities from one site with another. This defeats the isolation guarantee that prevents a compromised renderer from reading data belonging to other origins.

Root Cause

The root cause is classified under CWE-706, which covers the use of an incorrectly-resolved name or reference. In this instance, the Speech component fails to validate that a referenced object belongs to the expected origin or process context. The mismatch allows objects intended for one security principal to be reached from another. Full technical details are tracked in Chromium Issue #520481800.

Attack Vector

Exploitation requires two stages. First, the attacker must already have compromised the renderer process, typically through a separate memory-corruption or logic bug delivered via a malicious page. Second, the attacker serves a crafted HTML page that triggers Speech reference resolution in a way that crosses the site isolation boundary. The result is that renderer-confined code gains access to cross-origin data or capabilities that site isolation is designed to block. Google's Chrome stable channel update documents the patched build.

No public proof-of-concept is available. Because the bug requires a pre-existing renderer compromise, it functions as one link in an exploit chain rather than a standalone remote attack.

Detection Methods for CVE-2026-79103

Indicators of Compromise

Chrome or Chromium-based browser processes running versions earlier than 152.0.7977.65 in enterprise inventory scans
Renderer processes exhibiting unexpected access to cross-origin resources or Speech API activity uncorrelated with user interaction
Browser crash reports referencing the Speech component preceding anomalous network egress

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65 as vulnerable
Correlate browser process telemetry with unusual child-process spawning or memory access patterns indicative of renderer compromise
Monitor HTTP traffic for pages that combine renderer-exploit payloads with Web Speech API invocations

Monitoring Recommendations

Track Chrome auto-update deployment status through endpoint management to confirm timely patching
Ingest browser and process telemetry into a centralized data lake for retrospective hunting across renderer-related anomalies
Alert on outbound connections from browser processes to newly registered or low-reputation domains hosting HTML payloads

How to Mitigate CVE-2026-79103

Immediate Actions Required

Update Google Chrome Desktop to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Verify that Chromium-based browsers in the environment have absorbed the upstream fix from the affected Speech component
Confirm that Chrome auto-update is enabled and functioning on managed devices to reduce exposure windows on future browser CVEs

Patch Information

Google released the fix in Chrome stable channel version 152.0.7977.65. Deployment details are published in the Chrome Releases blog post. Enterprises using MSI, DMG, or package-manager deployments should pull the updated installer and roll it out through their standard software distribution process. Chromium downstream projects should track the fix via Chromium Issue #520481800.

Workarounds

No official workaround exists; patching to 152.0.7977.65 is the supported remediation path
Reduce attack surface by restricting untrusted browsing on high-value workstations until the patch is deployed
Enforce enterprise policies that block browser extensions and sites known to deliver renderer exploits

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion