CVE-2026-79178: Google Chrome Passkeys Auth Bypass Flaw

CVE-2026-79178 is an authorization bypass vulnerability in Google Chrome's Web Authentication system affecting Passkeys and Security Keys. Attackers can exploit web origin policy bypasses through malicious HTML pages. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-79178 Overview

CVE-2026-79178 is an incorrect authorization vulnerability in the Web Authentication (WebAuthn) component of Google Chrome. The flaw affects passkeys and security keys handling in versions prior to 152.0.7977.65. A remote attacker can bypass the web origin policy by serving a crafted HTML page to a victim. Chromium security engineers rated the severity as Medium. The vulnerability is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Successful exploitation lets a remote attacker circumvent same-origin restrictions on WebAuthn credentials, undermining the phishing-resistance guarantees of passkeys and hardware security keys.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers embedding vulnerable WebAuthn code
Downstream distributions tracking the Chromium stable channel

Discovery Timeline

2026-08-25 - CVE-2026-79178 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database
2026-08-25 - Google published the Chrome Stable Channel Update addressing the issue

Technical Details for CVE-2026-79178

Vulnerability Analysis

The vulnerability resides in the Web Authentication subsystem that brokers passkey and security key operations between web origins and the browser's authenticator layer. WebAuthn enforces strict origin binding so that credentials created for example.com can only be used by pages served from example.com. Chrome's implementation failed to correctly enforce this authorization check under specific conditions, letting a crafted page interact with credentials outside its origin scope.

This undermines the core security guarantee of passkeys: cryptographic binding to the Relying Party Identifier (RP ID). When origin enforcement is bypassed, phishing pages can request assertions that browsers should refuse. The EPSS score reflects a low probability of exploitation activity in the near term, but the flaw remains security-relevant because it targets the authentication layer directly.

Root Cause

The root cause is an authorization check gap [CWE-863] in how Chrome validated the calling web origin against the credential's registered Relying Party during WebAuthn ceremonies. See the Chromium Issue Tracker entry for tracking details.

Attack Vector

Exploitation requires a victim to visit a crafted HTML page under attacker control. The page invokes the WebAuthn JavaScript API in a manner that triggers the incorrect authorization path. No memory corruption or elevated privileges are required. The realistic attack scenario is a phishing campaign that leverages the bypass to obtain assertions bound to a different origin, potentially enabling account takeover against sites protected by passkeys.

No verified proof-of-concept code has been published. Technical specifics are described in the linked Chromium and Chrome release references.

Detection Methods for CVE-2026-79178

Indicators of Compromise

Browser telemetry showing WebAuthn assertion requests originating from unexpected or newly registered domains targeting high-value Relying Parties
Authentication logs recording successful passkey assertions preceded by user navigation to unfamiliar URLs
Chrome versions below 152.0.7977.65 observed in endpoint inventory during authentication events

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build earlier than 152.0.7977.65
Correlate Identity Provider (IdP) WebAuthn assertion logs with browser user-agent strings to identify assertions performed by unpatched clients
Monitor for phishing infrastructure that hosts pages invoking the navigator.credentials.get() API against production Relying Party Identifiers

Monitoring Recommendations

Enable enterprise browser telemetry to report installed version and update status to the Security Operations Center
Alert on WebAuthn authentication events where the browser build predates the fixed version
Track anomalous passkey usage patterns such as sign-ins from unusual geolocations or from devices not previously bound to the account

How to Mitigate CVE-2026-79178

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Force-restart Chrome on managed devices to complete the update installation
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the same upstream fix

Patch Information

Google released the fix in the Chrome stable channel at version 152.0.7977.65. Deployment details are documented in the Chrome Stable Channel Update announcement. Enterprises using Chrome Browser Cloud Management or Group Policy should verify that automatic updates are enabled and unblocked.

Workarounds

No sanctioned configuration workaround exists; apply the vendor patch as the primary remediation
Restrict use of passkeys and security keys to updated browsers by enforcing minimum browser version policies at the Identity Provider
Reinforce user awareness training to reduce the likelihood of victims interacting with crafted phishing pages that abuse WebAuthn flows

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Enterprise policy example (Windows) to enforce minimum version via update channel
# HKLM\Software\Policies\Google\Update\TargetVersionPrefix{8A69D345-D564-463C-AFF1-A69D9E530F96}=152.0.7977.65