CVE-2026-79136: Google Chrome Authorization Bypass Vulnerability

CVE-2026-79136 Overview

CVE-2026-79136 is an incorrect authorization vulnerability in the ServiceWorker component of Google Chrome prior to version 152.0.7977.65. A remote attacker can bypass the web origin policy by serving a crafted HTML page. Google's Chromium project classifies the security severity as Medium. The flaw maps to CWE-863: Incorrect Authorization and affects the Service Worker authorization logic that enforces same-origin boundaries between web resources.

Critical Impact
A crafted web page can bypass Chrome's web origin policy through the Service Worker, potentially exposing cross-origin resources to attacker-controlled scripts.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers incorporating the affected Service Worker code
Chrome Stable channel releases before the August 2026 desktop update

Discovery Timeline

2026-08-25 - CVE-2026-79136 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79136

Vulnerability Analysis

The vulnerability resides in Chrome's Service Worker implementation. Service Workers are background scripts that intercept and handle network requests for web applications. They must strictly enforce the web origin policy so that a script registered under one origin cannot observe or manipulate responses belonging to another origin.

In affected Chrome builds, an authorization check in the Service Worker path allows a crafted HTML page to reach resources or functionality that should be restricted by origin. The result is a same-origin policy bypass initiated from a normal web navigation, requiring only that the victim visit an attacker-controlled page.

Root Cause

The root cause is an incorrect authorization decision [CWE-863] inside the Service Worker component. The code path fails to correctly validate the requesting origin against the resource origin before granting access. Because Service Workers proxy fetch traffic for their scope, a flawed authorization check can leak cross-origin data or extend a Service Worker's control beyond its intended origin.

Attack Vector

Exploitation is remote and requires user interaction limited to visiting a malicious page. The attacker hosts a crafted HTML document that registers or interacts with a Service Worker in a way that triggers the flawed authorization logic. Successful exploitation lets the attacker access cross-origin content or perform actions in another origin's security context. Refer to the Google Chrome Desktop Update and the Chromium Issue Tracker for vendor details.

Detection Methods for CVE-2026-79136

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 in enterprise inventory data.
Unexpected Service Worker registrations for domains that do not normally deploy them, especially from ad networks or newly observed domains.
Web proxy logs showing repeated cross-origin fetch activity originating from a single tab following navigation to an untrusted site.

Detection Strategies

Query endpoint telemetry for installed Chrome versions and flag hosts below 152.0.7977.65.
Inspect browser Service Worker storage (ServiceWorker/ directory under the Chrome user data path) for unexpected script origins.
Correlate web gateway logs with browsing history to identify visits to low-reputation domains that register Service Workers.

Monitoring Recommendations

Enforce browser version reporting through management tooling such as Chrome Browser Cloud Management.
Alert on outbound requests to newly registered domains that are followed by persistent background fetches indicative of a Service Worker.
Monitor DLP and CASB telemetry for anomalous cross-origin data access following user navigation events.

How to Mitigate CVE-2026-79136

Immediate Actions Required

Update Google Chrome Desktop to version 152.0.7977.65 or later on all managed endpoints.
Restart browser sessions after deployment to ensure the patched Service Worker code path is loaded.
Verify Chromium-based derivative browsers have merged the corresponding upstream fix before considering remediation complete.

Patch Information

Google released the fix in the Chrome Stable channel update announced on the Chrome Releases blog. Administrators should push version 152.0.7977.65 or higher through Chrome Browser Cloud Management, Group Policy, MDM, or the equivalent update mechanism. Additional context is available in the Chromium Issue Tracker entry.

Workarounds

Restrict access to untrusted websites through web filtering categories until patching is complete.
Disable Service Workers for high-risk user populations via the URLBlocklist policy targeting untrusted origins.
Isolate browsing of unknown content using site isolation or a remote browser isolation solution.

bash

# Example: Force Chrome update via Group Policy target version on Windows
# Registry path: HKLM\Software\Policies\Google\Update
# Value: TargetVersionPrefix{8A69D345-D564-463C-AFF1-A69D9E530F96}
# Data: 152.0.7977.65

reg add "HKLM\Software\Policies\Google\Update" /v \
  "TargetVersionPrefix{8A69D345-D564-463C-AFF1-A69D9E530F96}" /t REG_SZ /d "152.0.7977.65" /f