CVE-2026-79116: Google Chrome Viz Auth Bypass Vulnerability

CVE-2026-79116 Overview

CVE-2026-79116 is a missing authorization vulnerability in the Viz component of Google Chrome prior to version 152.0.7977.65. The flaw allows a remote attacker who has already compromised the renderer process to bypass the web origin policy through a crafted HTML page. Google rated the Chromium security severity as Medium. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
An attacker with a compromised renderer can violate same-origin boundaries, enabling cross-origin data access and expanding the impact of an existing renderer exploit.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable Viz component
Desktop platforms served by the Chrome Stable channel

Discovery Timeline

2026-08-25 - CVE-2026-79116 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79116

Vulnerability Analysis

The vulnerability resides in Viz, the Chromium subsystem that handles GPU-accelerated compositing and display for the browser. Viz brokers rendering work between renderer processes and the GPU process, and it must enforce origin boundaries when handling frame and surface data on behalf of renderers. This issue represents a missing authorization check in that broker path.

The web origin policy isolates content from different sites so that one origin cannot read data from another. A missing authorization check in Viz breaks that guarantee when a renderer submits crafted requests. An attacker who already controls a renderer process, typically through a chained memory corruption bug, can leverage this flaw to reach data or surfaces owned by a different origin.

Exploitation requires two stages. The attacker first compromises a renderer, then delivers a crafted HTML page that triggers the missing check in Viz to escape origin isolation.

Root Cause

The root cause is an absent authorization check on a Viz IPC path that services renderer requests. Chromium's sandbox model treats renderers as untrusted, so cross-process interfaces must validate that the calling renderer owns the resource or origin it references. When that validation is missing, a compromised renderer can act on behalf of other origins.

Attack Vector

The attack vector is remote and browser-based, but it is not a single-stage drive-by. The attacker must first compromise a renderer process, then serve a crafted HTML page that exercises the vulnerable Viz interface. Successful exploitation results in a bypass of the same-origin policy rather than direct code execution. Details are tracked in Chromium Issue #502232151 and the Google Chrome Stable Update.

No public proof-of-concept code has been released. The vulnerability is described in prose in the vendor advisory without disclosed exploit code.

Detection Methods for CVE-2026-79116

Indicators of Compromise

Chrome processes running versions earlier than 152.0.7977.65 on managed endpoints
Renderer or GPU process crashes correlated with visits to untrusted HTML content
Unexpected cross-origin data access patterns in browser telemetry or web application logs

Detection Strategies

Inventory installed Chrome and Chromium-derivative browser versions across the fleet and flag builds below 152.0.7977.65.
Monitor endpoint process telemetry for anomalous child process behavior spawned from chrome.exe, including unexpected GPU or utility process activity.
Correlate browser navigation events with subsequent sensitive resource access to identify potential origin bypass activity.

Monitoring Recommendations

Ingest browser version telemetry into a centralized data lake to track patch compliance over time.
Alert on renderer sandbox escape indicators, since this bug requires a pre-existing renderer compromise to be useful.
Track access to Chromium security bulletins and Chromium issue tracker entries referenced in the Google Chrome Stable Update for related fixes.

How to Mitigate CVE-2026-79116

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all desktop platforms.
Force restart of Chrome after update deployment to ensure the patched binary is loaded.
Verify Chromium-based browsers such as Edge, Brave, and Opera have absorbed the upstream Viz fix before considering endpoints remediated.

Patch Information

Google addressed the issue in the Chrome Stable channel with version 152.0.7977.65. Patch details are published in the Google Chrome Stable Update advisory, with the underlying defect tracked as Chromium Issue #502232151. Administrators should distribute the update through enterprise management channels and confirm rollout using version telemetry.

Workarounds

Restrict browsing to trusted sites through enterprise policy until patch deployment completes.
Enable Chrome's Enhanced Safe Browsing to reduce exposure to crafted HTML delivered from untrusted origins.
Apply site isolation policies and block execution of unnecessary browser extensions that increase renderer attack surface.

bash

# Verify installed Chrome version on Linux and macOS endpoints
google-chrome --version
# Expected output: Google Chrome 152.0.7977.65 or later

# Windows PowerShell version check
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion