CVE-2026-79141: Google Chrome Browser Authorization Bypass

CVE-2026-79141 Overview

CVE-2026-79141 is an incorrect authorization vulnerability in the Browser component of Google Chrome prior to version 152.0.7977.65. A remote attacker can bypass the web origin policy by serving a crafted HTML page to a victim. Chromium classifies the flaw as Medium severity and tracks it under CWE-863: Incorrect Authorization.

The issue affects the browser process rather than a single renderer, so successful exploitation weakens the same-origin boundary that separates web content. Google addressed the defect in the Chrome Stable channel and referenced the fix through internal Chromium issue tracking.

Critical Impact
Remote attackers can bypass web origin policy enforcement using a crafted HTML page, undermining the isolation between web origins.

Affected Products

Google Chrome Desktop prior to 152.0.7977.65
Chromium-based browsers that inherit the vulnerable Browser code path
Downstream distributions bundling pre-patch Chromium releases

Discovery Timeline

2026-08-25 - CVE-2026-79141 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79141

Vulnerability Analysis

The vulnerability resides in the Browser process of Google Chrome and stems from incorrect authorization checks when handling cross-origin interactions. Chrome enforces the web origin policy to ensure that scripts, storage, and privileged APIs remain scoped to a single origin. When authorization logic is misapplied, an attacker-controlled page can obtain access or perform actions that the origin model would normally forbid.

A remote attacker exploits the flaw by hosting a crafted HTML page and enticing a victim to load it. Because the trigger is a standard web navigation, no additional privileges or user interaction beyond visiting the page are required. The Chromium project rates the flaw Medium severity, indicating limited but non-trivial impact on confidentiality and integrity of cross-origin data.

Root Cause

The defect is categorized as CWE-863: Incorrect Authorization. Authorization logic in the Browser component fails to correctly validate the origin context of a requested operation. As a result, checks that should reject cross-origin access instead permit it under specific conditions triggered by the crafted page. Public details are limited pending the standard Chromium disclosure window; see the Chromium Issue #538969297 tracker for restricted technical detail.

Attack Vector

Exploitation occurs entirely through the web. An attacker delivers the crafted HTML through a controlled site, a compromised third-party page, or malvertising. When the browser processes the page, the flawed authorization path allows origin policy bypass. No local access, credentials, or additional software on the victim host are required. See the Google Chrome Stable Update announcement for the vendor confirmation of the fix.

No verified public exploit code is available. The vulnerability is described in prose because Chromium restricts issue visibility until users have updated.

Detection Methods for CVE-2026-79141

Indicators of Compromise

Chrome browser processes at versions earlier than 152.0.7977.65 observed on managed endpoints
Outbound HTTP(S) requests to unfamiliar domains immediately followed by cross-origin data access patterns in browser telemetry
Web content requesting resources or APIs inconsistent with the loaded top-level origin

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions across the fleet and flag builds below 152.0.7977.65
Correlate browser process telemetry with proxy or DNS logs to identify pages that trigger unexpected cross-origin fetches
Review endpoint detection and response (EDR) events for Chrome child processes accessing unexpected profile files or credential stores

Monitoring Recommendations

Track Chrome auto-update status through enterprise management policies and alert on stalled updates
Monitor web proxy logs for hosts serving unusual HTML payloads to internal users
Ingest browser and endpoint logs into a centralized data lake for correlation across origin, process, and network events

How to Mitigate CVE-2026-79141

Immediate Actions Required

Update Google Chrome Desktop to 152.0.7977.65 or later on all supported operating systems
Force a browser restart after deployment so the patched Browser process is loaded
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the upstream Chromium fix

Patch Information

Google released the fix in the Chrome Stable channel. Refer to the Google Chrome Stable Update advisory for the exact build and channel information. Verify the running version by navigating to chrome://settings/help and confirming the reported build is 152.0.7977.65 or higher.

Workarounds

Restrict browsing to trusted sites via enterprise policy until patches are deployed
Enforce Site Isolation and disable non-essential experimental flags through Chrome enterprise policies
Use web filtering to block newly registered or low-reputation domains that could host crafted HTML payloads

bash

# Verify Chrome version on Linux endpoints and flag vulnerable builds
google-chrome --version | awk '{print $3}' | \
  awk -F. '{ if ($1 < 152 || ($1==152 && $3 < 7977) || ($1==152 && $3==7977 && $4 < 65)) \
  print "VULNERABLE: update required"; else print "OK" }'