CVE-2026-79106: Google Chrome Input Auth Bypass Vulnerability

CVE-2026-79106 Overview

CVE-2026-79106 is an improper input validation vulnerability [CWE-20] in the Input component of Google Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can leverage social engineering to bypass the web origin policy through a crafted HTML page. Google rates the Chromium security severity as Medium. The flaw requires both prior renderer compromise and user interaction, which raises the exploitation bar. Google addressed the issue in the Chrome Stable channel update for desktop.

Critical Impact
Successful exploitation allows an attacker with an existing renderer foothold to bypass the same-origin policy and access cross-origin content through a specially crafted HTML page.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers sharing the affected Input component
Downstream Chromium distributions pending backport of the fix

Discovery Timeline

2026-08-25 - CVE-2026-79106 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79106

Vulnerability Analysis

The vulnerability resides in Chrome's Input handling logic. Improper validation of input state allows an attacker to manipulate browser behavior in ways that violate the web origin policy. Because the flaw requires a compromised renderer process, the attacker must first chain this issue with another vulnerability or a malicious extension. Once inside the renderer, the attacker uses a crafted HTML page combined with social engineering to trigger the bypass. The result is unauthorized access to content across origin boundaries that the browser should isolate.

Root Cause

The root cause is improper input validation [CWE-20] in the Input subsystem. Chrome fails to fully validate data crossing trust boundaries between the compromised renderer and higher-privilege components enforcing origin policy. This gap enables the origin policy bypass documented by Google in the Chromium issue tracker.

Attack Vector

Exploitation requires two preconditions. First, the attacker must control the renderer process, typically through a separate memory-corruption or logic bug. Second, the attacker must convince the user to interact with a crafted HTML page, satisfying the social-engineering requirement. Refer to the Google Chrome Stable Update advisory and Chromium Issue Tracker #497456156 for vendor-provided technical context.

// No verified proof-of-concept code is publicly available for CVE-2026-79106.
// Exploitation requires a pre-existing renderer compromise plus user
// interaction with a crafted HTML page hosted by the attacker.

Detection Methods for CVE-2026-79106

Indicators of Compromise

Chrome processes rendering unexpected cross-origin content following user interaction with untrusted HTML pages.
Renderer processes exhibiting anomalous IPC traffic or crashes preceding cross-origin data access.
Browser telemetry showing origin policy violations tied to Chrome builds earlier than 152.0.7977.65.

Detection Strategies

Inventory endpoints for Chrome versions below 152.0.7977.65 using endpoint management or EDR software inventory data.
Monitor for known renderer-compromise precursors, since this bug is only exploitable after such compromise.
Correlate suspicious HTML page visits with subsequent process behavior anomalies in Chrome child processes.

Monitoring Recommendations

Enable Chrome Enterprise reporting to capture crash and security events from managed browsers.
Track outbound network connections from renderer processes to newly registered or low-reputation domains.
Alert on Chrome extension installations from unmanaged sources, as they are a common initial vector for renderer compromise.

How to Mitigate CVE-2026-79106

Immediate Actions Required

Update all Chrome installations to version 152.0.7977.65 or later on Windows, macOS, and Linux.
Restart Chrome after updating to ensure the patched binaries are loaded.
Audit deployed Chromium-based browsers and apply vendor updates that incorporate the upstream fix.

Patch Information

Google released the fix in the Chrome Stable channel update tracked in the Google Chrome Stable Update announcement. Additional context is available in Chromium Issue Tracker #497456156. Administrators should deploy 152.0.7977.65 or later through their standard browser update channels.

Workarounds

Enforce automatic Chrome updates via Chrome Enterprise policies until manual patching completes.
Restrict installation of untrusted extensions to reduce the likelihood of an initial renderer compromise.
Train users to recognize social engineering lures that direct them to interact with unfamiliar HTML content.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Force update check via Chrome Enterprise on managed fleets
# (Windows example using Group Policy registry key)
# HKLM\Software\Policies\Google\Update\AutoUpdateCheckPeriodMinutes = 60