CVE-2026-79108: Chrome Web Authentication Bypass Vulnerability

CVE-2026-79108 is an authentication bypass flaw in Google Chrome Web Authentication affecting Passkeys and Security Keys. Attackers can exploit UI misrepresentation through social engineering to bypass access restrictions. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-79108 Overview

CVE-2026-79108 is a user interface misrepresentation vulnerability in the Web Authentication (WebAuthn) component of Google Chrome. The flaw affects Passkeys and Security Keys handling in versions prior to 152.0.7977.65. A remote attacker can craft an HTML page that spoofs authentication UI elements to mislead users. Successful exploitation requires user interaction and social engineering. The issue maps to CWE-451: User Interface (UI) Misrepresentation of Critical Information. Chromium developers rated the internal security severity as Low, while the NVD assessment places integrity impact at High.

Critical Impact
An attacker can bypass system access restrictions by tricking a user into interacting with a spoofed WebAuthn prompt, undermining trust in Passkeys and security key ceremonies.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers embedding the affected WebAuthn UI code
Web Authentication (Passkeys and Security Keys) subsystem

Discovery Timeline

2026-08-25 - CVE-2026-79108 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79108

Vulnerability Analysis

The vulnerability resides in how Chrome renders WebAuthn ceremony prompts for Passkeys and hardware Security Keys. An attacker-controlled HTML page can manipulate the browser UI to misrepresent the origin, purpose, or trust state of an authentication request. Users relying on visual cues to validate the ceremony may approve authentication against a context that differs from what the UI implies. The result is a bypass of system access restrictions gated by WebAuthn.

The attack targets the visual channel that users depend on to verify high-assurance authentication. Because Passkeys are marketed as phishing-resistant, a UI spoofing flaw in the ceremony itself erodes the primary security property of the mechanism. Exploitation does not require compromising the underlying cryptographic protocol.

Root Cause

The root cause is improper representation of security-critical information in the WebAuthn UI layer, categorized under CWE-451. Chrome does not sufficiently isolate or authenticate elements of the Passkey and Security Key prompts from content controlled by the loaded page. See Chromium Issue #522304549 for the upstream tracking record.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page and lures a target through phishing or malicious redirection. When the victim loads the page, the attacker triggers a WebAuthn ceremony whose UI representation misleads the user into completing an authentication that grants unintended access. No privileges or credentials are required from the attacker before the interaction. See the Google Chrome Desktop Update advisory for vendor context.

No public proof-of-concept or in-the-wild exploitation has been reported. The EPSS forecast places the near-term exploitation probability in the low single digits.

Detection Methods for CVE-2026-79108

Indicators of Compromise

Browser telemetry showing WebAuthn ceremonies triggered from newly registered or low-reputation domains
User reports of unexpected Passkey or Security Key prompts following link clicks in email, chat, or ads
Authentication success events on sensitive applications immediately preceded by navigation to an unrelated external page

Detection Strategies

Correlate browser navigation logs with identity provider WebAuthn assertion events to identify prompts originating from suspicious origins
Alert on Chrome desktop clients running versions earlier than 152.0.7977.65 in endpoint inventory data
Monitor for phishing infrastructure serving pages that invoke the navigator.credentials.get() WebAuthn API against enterprise identity providers

Monitoring Recommendations

Ingest browser version telemetry into the security data lake and flag hosts pending the Chrome 152 update
Track identity provider logs for anomalous Passkey usage patterns, including new device registrations from unusual geographies
Review web proxy logs for HTML pages containing WebAuthn calls served from domains with recent registration dates

How to Mitigate CVE-2026-79108

Immediate Actions Required

Update Google Chrome Desktop to version 152.0.7977.65 or later across all managed endpoints
Force browser relaunch through enterprise management tooling to ensure the patched binary is active
Reinforce user awareness that Passkey and Security Key prompts should be validated against the expected relying party before approval

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Desktop Update advisory. Upgrading to 152.0.7977.65 or later remediates CVE-2026-79108. Chromium downstream projects should incorporate the corresponding patch from Chromium Issue #522304549.

Workarounds

Deploy enterprise policy to restrict WebAuthn usage to allow-listed relying party origins where feasible
Require security key ceremonies to occur only from bookmarked or SSO-launched URLs rather than inbound links
Block newly registered and low-reputation domains at the web proxy to reduce phishing exposure until patching is complete

bash

# Verify the installed Chrome version meets or exceeds the fixed build
google-chrome --version
# Expected: Google Chrome 152.0.7977.65 or later