CVE-2026-79123: Google Chrome Auth Bypass Vulnerability

CVE-2026-79123 Overview

CVE-2026-79123 is an improper input validation vulnerability [CWE-20] affecting the New Tab Page (NTP) Footer component in Google Chrome on Windows. Versions prior to 152.0.7977.65 fail to correctly validate input, allowing a remote attacker who has already compromised the renderer process to bypass web origin policy through a crafted HTML page. Chromium classifies the security severity as Low, while NVD assigns a CVSS 3.1 base score of 6.5. Successful exploitation requires user interaction and a prior renderer compromise, limiting the practical attack surface. The primary impact is integrity, not confidentiality or availability.

Critical Impact
An attacker who has compromised the renderer process can bypass the same-origin policy in Chrome on Windows, enabling cross-origin actions from a crafted page.

Affected Products

Google Chrome on Windows prior to 152.0.7977.65
Microsoft Windows platforms running vulnerable Chrome builds
Chromium-based deployments packaging affected Chrome versions

Discovery Timeline

2026-08-25 - CVE-2026-79123 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79123

Vulnerability Analysis

The flaw resides in the NTP Footer feature of Google Chrome, a UI surface rendered on the New Tab Page. Chrome fails to properly validate input handled by this component, allowing crafted HTML to influence behavior that should remain isolated to a specific web origin. The result is a web origin policy bypass, which weakens the browser's fundamental cross-origin boundary and enables an attacker to perform actions against content from a different origin than the attacker-controlled context.

Exploitation requires that the attacker has already compromised the renderer process. This precondition typically follows a chained exploit involving a separate memory corruption or logic bug in the renderer. The vulnerability then serves as a secondary primitive to escalate impact by breaking the same-origin policy rather than as an initial access vector.

Root Cause

The root cause is improper input validation [CWE-20] in the NTP Footer code path. The component accepts data that should be scoped to the New Tab Page origin without enforcing the origin checks required by Chrome's site isolation model. Input from a compromised renderer is trusted for operations that should be gated by origin, allowing the boundary to be crossed.

Attack Vector

The attack vector is network-based and requires user interaction, such as visiting a crafted HTML page in a compromised tab. The attacker must first control the renderer process, then deliver crafted content that triggers the NTP Footer input handling to perform actions against a different origin. There is no public exploit, no CISA KEV listing, and no reports of exploitation in the wild.

No verified proof-of-concept code is available. Refer to the Chromium Issue Tracker #517395590 and the Google Chrome Stable Update advisory for vendor-provided technical context.

Detection Methods for CVE-2026-79123

Indicators of Compromise

Chrome browser processes on Windows endpoints reporting versions earlier than 152.0.7977.65.
Renderer processes exhibiting crashes, unexpected child process spawns, or anomalous IPC patterns preceding cross-origin data access.
Outbound requests initiated from a New Tab Page context targeting unrelated web origins.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host below 152.0.7977.65.
Correlate renderer process crash telemetry with subsequent navigation events to detect potential exploit chains.
Alert on browser child processes loading unusual command lines or accessing sensitive local resources after visiting untrusted pages.

Monitoring Recommendations

Ingest browser process telemetry into the security data lake and normalize with OCSF for cross-source correlation.
Track Chrome update compliance as a continuous control, not a point-in-time check.
Monitor DNS and HTTP telemetry for connections to newly registered or low-reputation domains delivered through browser sessions.

How to Mitigate CVE-2026-79123

Immediate Actions Required

Update Google Chrome on all Windows endpoints to 152.0.7977.65 or later.
Force-restart Chrome after deployment to ensure the patched binary is loaded into memory.
Verify enterprise policy enforcement of automatic Chrome updates across managed devices.

Patch Information

Google addressed CVE-2026-79123 in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. The fixed version is 152.0.7977.65 for Windows. Enterprises using Chrome Browser Cloud Management or Group Policy should confirm that update deferral windows do not delay deployment beyond the patch release date.

Workarounds

Restrict browsing to trusted sites through enterprise URL allow-lists until patching completes.
Enable Chrome's Enhanced Safe Browsing to reduce exposure to malicious pages that could chain a renderer exploit.
Apply site isolation and strict extension controls via enterprise policy to limit renderer-level attack surface.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enforce automatic updates via Group Policy registry keys
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f