CVE-2026-79174: Google Chrome Extensions Auth Bypass Flaw

CVE-2026-79174 Overview

CVE-2026-79174 is an incorrect authorization vulnerability in the Extensions component of Google Chrome prior to version 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass the web origin policy and reach a privileged page through a crafted HTML page. Chromium engineers rated the security severity as High. The flaw is categorized under CWE-863: Incorrect Authorization and requires chaining with a prior renderer compromise to reach exploitation.

Critical Impact
An attacker with a compromised renderer can escape sandbox boundaries enforced by web origin policy and access privileged extension pages, expanding control over the browser session.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers sharing the affected Extensions authorization code
Desktop Chrome Stable channel builds before the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-79174 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79174

Vulnerability Analysis

The vulnerability resides in the Extensions subsystem of Chrome, where authorization checks fail to correctly enforce the web origin policy between a renderer process and a privileged extension page. Chrome's multi-process architecture isolates web content in sandboxed renderer processes, while privileged pages such as extension backgrounds and settings pages hold elevated capabilities. An attacker who first compromises a renderer through a separate flaw can leverage this incorrect authorization to cross that trust boundary.

Exploitation requires a crafted HTML page delivered to the compromised renderer. The renderer then issues requests or navigations that the Extensions authorization logic accepts as legitimate, granting access to privileged content that should remain isolated. This class of bug is typically part of a chain and is not exploitable directly from an unprivileged web origin without the prior renderer compromise.

Root Cause

The root cause is an incorrect authorization check [CWE-863] in the Extensions component. The check does not fully validate the origin or process context of the caller before permitting access to a privileged extension surface. As a result, requests originating from a hostile renderer are treated as if they satisfy the web origin policy.

Attack Vector

The attack vector is remote but requires a compromised renderer process as a prerequisite. The attacker serves a crafted HTML page to the target browser, which then executes logic that abuses the flawed authorization path to reach a privileged page. See the Chromium Issue Tracker #535876894 and the Google Chrome Stable Update for vendor-provided technical context.

Detection Methods for CVE-2026-79174

Indicators of Compromise

Unexpected navigations or fetch requests to chrome-extension:// URLs originating from web content contexts.
Renderer processes exhibiting anomalous cross-origin requests immediately followed by extension page loads.
Crashes, exceptions, or logged authorization failures in Chrome tied to Extensions message routing.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any endpoint running a build below 152.0.7977.65.
Correlate browser telemetry with endpoint process events to identify renderer processes that spawn or access privileged extension resources abnormally.
Monitor for known renderer-compromise precursors, since this bug requires a prior renderer exploit to be useful.

Monitoring Recommendations

Enforce Chrome auto-update policies and alert when browsers fall behind the current Stable channel version.
Ingest browser and endpoint telemetry into a centralized data lake for cross-process correlation and version compliance reporting.
Track outbound traffic from managed endpoints to newly registered domains that could host crafted exploit HTML.

How to Mitigate CVE-2026-79174

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all desktop platforms.
Restart browsers after the update so the patched binaries are loaded into memory.
Audit installed extensions and remove any that are unused, unmaintained, or from untrusted publishers.

Patch Information

Google released the fix in the Chrome Stable channel update announced in the Google Chrome Stable Update. Administrators should validate that managed endpoints have upgraded to 152.0.7977.65 or later. Chromium-based browser vendors typically ship equivalent fixes shortly after upstream; verify the version bundled with each downstream browser in use.

Workarounds

Enforce enterprise policies that disable installation of non-approved extensions until patching is complete.
Apply site isolation and strict extension permission policies through Chrome Enterprise policy templates.
Restrict browsing to trusted sites via network controls to reduce exposure to crafted HTML pages hosting renderer exploits.

bash

# Verify Chrome version on managed Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify Chrome version on Linux/macOS
google-chrome --version
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version