CVE-2026-79110: Google Chrome Authorization Bypass Vulnerability

CVE-2026-79110 Overview

CVE-2026-79110 is a missing authorization vulnerability [CWE-862] in the Preload component of Google Chrome. Versions prior to 152.0.7977.65 fail to enforce the web origin policy during preload operations. A remote attacker can bypass same-origin restrictions by serving a crafted HTML page to a target user. Google classifies the Chromium security severity as Medium.

The flaw affects the browser's speculative resource loading path, which fetches resources before a user navigates to them. When authorization checks are skipped, cross-origin data can be accessed in ways that violate the web origin model.

Critical Impact
A crafted HTML page can bypass the web origin policy in Chrome, enabling unauthorized cross-origin resource access through the Preload feature.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Preload code
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-08-25 - CVE-2026-79110 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79110

Vulnerability Analysis

The vulnerability resides in the Preload subsystem of Chrome. Preload allows the browser to fetch and initialize resources ahead of a user navigation to reduce perceived latency. The affected code path omits an authorization check that would normally enforce the web origin policy. As a result, an attacker-controlled page can trigger preload behavior that reaches into a different web origin without the expected access controls.

The issue is categorized under CWE-862: Missing Authorization. The EPSS data at publication indicates a low near-term exploitation probability, and there is no public evidence of exploitation in the wild.

Root Cause

The root cause is a missing authorization check in the Preload code path. Web origin policy enforcement is a foundational browser security boundary. When a code path handling cross-origin resources omits that check, the browser treats requests as if they were authorized within the same origin context. This deviates from the intended same-origin model that isolates web content across origins.

Attack Vector

Exploitation requires a user to load a crafted HTML page under attacker control. The attacker serves markup that triggers the vulnerable preload behavior. No authentication is required on the target, and no additional privileges on the client are needed beyond loading the page. User interaction is limited to visiting the malicious URL or loading attacker-controlled content in an existing tab.

For exploitation specifics, refer to the Chromium Issue Tracker Entry and the Google Chrome Stable Update advisory. No public proof-of-concept code is available at this time.

Detection Methods for CVE-2026-79110

Indicators of Compromise

Chrome browser versions reporting a User-Agent string with a build lower than 152.0.7977.65 in enterprise inventory
Outbound requests from browser processes to attacker-controlled domains initiated via <link rel="preload"> or <link rel="prefetch"> tags
Unexpected cross-origin resource fetches recorded in web proxy or DNS logs prior to explicit user navigation

Detection Strategies

Inventory endpoints for Chrome version compliance and flag any host running a build below 152.0.7977.65
Correlate browser process telemetry with network activity to identify anomalous cross-origin preload requests
Review web application access logs for referrers pointing to unknown or newly registered domains that may host crafted HTML

Monitoring Recommendations

Enforce Chrome auto-update policies through group policy or MDM and monitor version drift
Log and review browser child process network connections through EDR telemetry
Alert on user access to newly observed domains that subsequently trigger high-volume preload traffic

How to Mitigate CVE-2026-79110

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Restart Chrome after the update completes to ensure the patched binary is loaded
Verify Chromium-based browsers used in the environment have integrated the upstream fix

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Administrators should confirm that endpoints report 152.0.7977.65 or higher. Additional technical context is available in the Chromium Issue Tracker Entry.

Workarounds

Restrict browsing to trusted domains through enterprise web filtering until patch rollout completes
Deploy strict Content Security Policy headers on internal web applications to reduce cross-origin exposure
Consider temporarily disabling network prediction features via the NetworkPredictionOptions enterprise policy on unpatched endpoints

bash

# Configuration example: enforce Chrome minimum version via enterprise policy (Linux JSON policy)
{
  "NetworkPredictionOptions": 2,
  "ComponentUpdatesEnabled": true,
  "DefaultBrowserSettingEnabled": true
}