CVE-2026-79177: Google Chrome Media Auth Bypass Vulnerability

CVE-2026-79177 Overview

CVE-2026-79177 is an incorrect authorization vulnerability [CWE-863] in the Media component of Google Chrome on Windows prior to version 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass system access restrictions using a crafted HTML page. Chromium classifies the security severity as Low, while NVD assigns a CVSS 3.1 base score of 6.5 (Medium). User interaction is required to trigger the flaw. The issue was published to NVD on 2026-08-25 and last modified on 2026-08-27.

Critical Impact
An attacker with control of the renderer process can escape media access restrictions on Windows, enabling integrity impact through a crafted web page delivered to the victim.

Affected Products

Google Chrome for Windows versions prior to 152.0.7977.65
Chromium-based browsers on Windows sharing the same Media component code path
Downstream distributions that ship affected Chromium builds without the backported fix

Discovery Timeline

2026-08-25 - CVE-2026-79177 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79177

Vulnerability Analysis

The vulnerability resides in the Media subsystem of Google Chrome on Windows. The component fails to correctly enforce authorization when the renderer process requests media-related operations. An attacker who has already achieved code execution in a sandboxed renderer, typically through an earlier bug, can send crafted requests that the trusted browser process incorrectly honors. The result is a bypass of system access restrictions that Chromium normally enforces to isolate untrusted web content from privileged host resources. Because the flaw requires a prior renderer compromise and user interaction with a crafted HTML page, it is most useful as a second-stage primitive within an exploit chain.

Root Cause

The root cause is an incorrect authorization check [CWE-863] in the Media component. The code path validates that a request is well-formed but does not correctly confirm that the calling renderer is authorized to perform the requested media operation. This design flaw permits a compromised renderer to invoke privileged behavior that should remain restricted to the browser process. Details are tracked in Chromium Issue #520002854.

Attack Vector

Exploitation follows a two-stage model. First, the attacker compromises the Chrome renderer process, usually through a separate memory corruption or type confusion bug. Second, the attacker serves a crafted HTML page that the victim loads, and the compromised renderer issues media requests that bypass authorization checks in the browser process. The CVSS vector reflects network reach, low attack complexity, no privileges, required user interaction, and high integrity impact with no confidentiality or availability effect. See the Google Chrome Desktop Update for release context.

Detection Methods for CVE-2026-79177

Indicators of Compromise

Chrome renderer processes on Windows spawning or interacting with unexpected media device handles or COM interfaces
Outbound connections from Chrome to newly registered domains hosting HTML pages that trigger media APIs immediately on load
Browser telemetry showing renderer crashes or anomalous IPC traffic to the Media service preceding suspicious host activity

Detection Strategies

Inventory Chrome installations across Windows endpoints and flag any build below 152.0.7977.65 as vulnerable
Correlate browser process telemetry with subsequent access to microphone, camera, or media capture resources that lack a matching user prompt
Hunt for exploitation chains that combine a renderer memory-corruption identification with follow-on media authorization anomalies

Monitoring Recommendations

Ingest Chrome process, module, and network telemetry into a centralized data lake for retrospective hunting
Monitor Windows audio and video capture APIs for invocations attributed to browser child processes without corresponding user consent events
Alert on Chrome auto-update failures on managed endpoints so that unpatched hosts remain visible to the security team

How to Mitigate CVE-2026-79177

Immediate Actions Required

Update Google Chrome on Windows to version 152.0.7977.65 or later on all managed endpoints
Verify that Chrome auto-update is enabled and reaching endpoints, and remediate hosts that report stale versions
Restrict execution of untrusted browser extensions that could increase the likelihood of a renderer compromise chained with this bug

Patch Information

Google addressed CVE-2026-79177 in the Chrome Stable channel for Windows at version 152.0.7977.65. Administrators should consult the Google Chrome Desktop Update advisory and the Chromium Issue Tracker #520002854 for release metadata. Chromium-based browsers such as Microsoft Edge, Brave, and Opera should be updated once their vendors ship builds that incorporate the upstream fix.

Workarounds

Enforce enterprise policy that blocks navigation to untrusted sites and disables unnecessary media APIs where feasible
Deploy application allowlisting and least-privilege user accounts to constrain post-exploitation activity if a renderer is compromised
Segment high-value workstations from general-purpose browsing to reduce exposure while patch deployment is in progress

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force Chrome update check via command line
"C:\Program Files\Google\Chrome\Application\chrome.exe" --check-for-update-interval=1