CVE-2026-79143 Overview
CVE-2026-79143 is an incorrect authorization vulnerability in the FileSystem component of Google Chrome prior to version 152.0.7977.65. A remote attacker can craft an HTML page that, combined with social engineering, bypasses system access restrictions enforced by the browser. Google's Chromium team classified the security severity as Medium. The flaw is tracked under CWE-863: Incorrect Authorization and requires user interaction to succeed. Exploitation depends on convincing the user to visit or interact with attacker-controlled content.
Critical Impact
A crafted HTML page can bypass FileSystem access restrictions in Chrome, exposing local file operations to remote attacker control when a user is tricked into interacting with malicious content.
Affected Products
- Google Chrome desktop versions prior to 152.0.7977.65
- Chromium-based browsers sharing the affected FileSystem code path
- Downstream distributions bundling pre-152 Chromium releases
Discovery Timeline
- 2026-08-25 - CVE-2026-79143 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79143
Vulnerability Analysis
The defect resides in Chrome's FileSystem implementation, which mediates browser access to file and directory resources. Under normal operation, the FileSystem layer enforces origin-based and user-consent checks before allowing web content to reach system resources. This vulnerability breaks that enforcement path.
An attacker hosting a crafted HTML page can drive the FileSystem component into a state where authorization checks return an incorrect result. The behavior aligns with CWE-863, where an access decision is made but applies the wrong policy. Successful exploitation requires user interaction, consistent with the social engineering vector documented by Google.
Google's advisory does not disclose full internal details. See the Google Chrome Desktop Update and Chromium Issue Tracker #514454739 for vendor references. The EPSS probability is 0.272% at percentile 19.146 as of 2026-08-27.
Root Cause
The root cause is an authorization check within the FileSystem subsystem that does not correctly validate the requesting context against the resource being accessed. The check exists but applies an incomplete policy, allowing operations that the security model should deny.
Attack Vector
Exploitation is remote and browser-based. An attacker delivers a crafted HTML page over the web and uses social engineering to induce the victim to perform an action such as clicking, drag-and-drop, or approving a prompt. Once the user interacts, the FileSystem authorization bypass takes effect and the attacker gains access outside the intended sandbox constraints.
No public proof-of-concept or exploit tooling has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-79143
Indicators of Compromise
- Chrome browser processes reading or writing files outside expected user-approved directories following a web navigation event.
- Unexpected FileSystem API activity originating from recently visited untrusted origins.
- Endpoints running Chrome versions below 152.0.7977.65 after the vendor patch window.
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65.
- Correlate browser child-process file access with parent tab origin to identify anomalous cross-origin file operations.
- Monitor endpoint telemetry for HTML files launched from download directories immediately followed by local file reads.
Monitoring Recommendations
- Ingest browser and endpoint file-access events into a central data lake for cross-source correlation.
- Alert on Chrome processes accessing sensitive paths such as user profile directories, SSH keys, or credential stores shortly after external navigation.
- Track user-reported social engineering attempts referencing browser prompts, downloads, or file dialogs.
How to Mitigate CVE-2026-79143
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
- Force-restart Chrome after deployment so the patched binary is loaded in active user sessions.
- Verify that Chromium-based enterprise browsers have absorbed the corresponding upstream fix.
Patch Information
Google released the fix in the Chrome Stable channel at version 152.0.7977.65. Refer to the Google Chrome Desktop Update advisory and Chromium Issue Tracker #514454739 for the authoritative release notes and issue metadata.
Workarounds
- Enforce automatic Chrome updates through enterprise policy so users cannot defer the patched build.
- Restrict access to untrusted websites via web filtering until the update is confirmed installed.
- Reinforce user awareness training on social engineering tactics that abuse browser file prompts and downloads.
# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version
# Expected output should be: Google Chrome 152.0.7977.65 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
