CVE-2026-79137: Google Chrome Extension Auth Bypass Flaw

CVE-2026-79137 Overview

CVE-2026-79137 is an incorrect authorization vulnerability [CWE-863] in the Extensions component of Google Chrome. Versions of Chrome prior to 152.0.7977.65 fail to properly enforce system access restrictions when handling crafted extensions. A remote attacker who leverages social engineering to convince a user to install a malicious extension can bypass authorization controls. Google's Chromium project assigned the issue a Medium security severity rating.

The flaw does not require prior authentication on the target system. Exploitation depends on user interaction, specifically installing an attacker-controlled Chrome extension.

Critical Impact
A crafted Chrome extension can bypass system access restrictions in the Extensions subsystem, granting an attacker capabilities beyond those the browser's authorization model should permit.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers that inherit the vulnerable Extensions code
Managed Chrome deployments that have not applied the stable channel update

Discovery Timeline

2026-08-25 - CVE-2026-79137 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79137

Vulnerability Analysis

The vulnerability resides in the Chrome Extensions subsystem. Chrome's extension model relies on a permission and authorization framework to gate access to sensitive browser and system capabilities. In affected builds, that authorization check is applied incorrectly, allowing an extension to reach functionality it should not be permitted to invoke.

Because the flaw is classified under CWE-863: Incorrect Authorization, the underlying code performs an authorization decision but reaches the wrong conclusion. The result is that a crafted extension can operate outside the intended sandbox boundary and bypass system access restrictions enforced by the browser.

Exploitation is remote in the sense that the extension can be delivered from any web-accessible source. However, the attacker must persuade the user to install the extension, which is why Google's advisory language calls out social engineering as the delivery mechanism.

Root Cause

The root cause is an authorization logic defect in code paths reachable from installed extensions. A privileged capability check either evaluates the wrong subject, uses stale state, or is missing on a code path that should require it. See Chromium Issue Tracker #505951430 for the upstream tracking record.

Attack Vector

The attack requires an attacker to publish or deliver a crafted Chrome extension and convince a target to install it. Typical delivery channels include lookalike listings in extension marketplaces, sideloaded packages, malvertising, phishing pages that link to install prompts, and bundled installers. Once installed, the extension exercises the flawed authorization path to reach restricted functionality without additional user consent.

Because no verified proof-of-concept code has been published, the specific API surface and payload details are not documented in prose here. Refer to the Google Chrome Stable Update advisory for vendor guidance.

Detection Methods for CVE-2026-79137

Indicators of Compromise

Chrome extensions installed outside the enterprise-approved allowlist, especially those sideloaded via developer mode or --load-extension command-line flags
Extensions requesting broad host permissions (<all_urls>) or nativeMessaging where the business justification is unclear
Endpoints running Chrome builds earlier than 152.0.7977.65 after the patch release date
Outbound connections from chrome.exe child processes to unfamiliar domains shortly after new extension installation

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an approved allowlist
Alert on Chrome process command lines containing --load-extension, --disable-extensions-except, or --enable-easy-off-store-extension-install
Correlate new extension installation events with subsequent process creation, file system, or network anomalies from the Chrome process tree
Query browser telemetry for versions of Chrome that remain below 152.0.7977.65

Monitoring Recommendations

Ingest Chrome management events and OS-level process telemetry into a centralized data platform for extension activity baselining
Monitor for user reports of unexpected browser behavior, unauthorized page modifications, or new toolbar entries after extension installation
Track Chrome update status across the fleet to confirm that patched builds are actually running, not just downloaded

How to Mitigate CVE-2026-79137

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all desktop platforms
Force a browser restart to ensure the patched binary is active, since Chrome only applies updates after relaunch
Audit currently installed extensions and remove any that are unknown, unused, or outside the approved allowlist
Communicate to users that they should not install Chrome extensions delivered via email links, pop-ups, or unverified sites

Patch Information

Google fixed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. The fixed version is 152.0.7977.65. Enterprise administrators using Chrome Browser Cloud Management or Group Policy should confirm that automatic updates are enabled and that the minimum version policy enforces the patched build.

Workarounds

Enforce an extension allowlist using the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies until patching is complete
Set ExtensionInstallBlocklist to * to block all non-approved extensions during remediation windows
Disable Chrome developer mode for standard users via the DeveloperToolsAvailability policy to prevent sideloading of unpacked extensions
Restrict install sources to the Chrome Web Store using ExtensionInstallSources

bash

# Example Chrome enterprise policy (JSON) enforcing allowlist-only extensions
# Deploy via Group Policy, Chrome Browser Cloud Management, or platform MDM
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "approved_extension_id_1",
    "approved_extension_id_2"
  ],
  "ExtensionInstallSources": [
    "https://clients2.google.com/service/update2/crx"
  ],
  "DeveloperToolsAvailability": 2,
  "BrowserVersionMinimum": "152.0.7977.65"
}