CVE-2026-79184: Google Chrome Authorization Bypass Vulnerability

CVE-2026-79184 Overview

CVE-2026-79184 is a missing authorization vulnerability [CWE-862] in the Preload component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass the web origin policy by serving a crafted HTML page. Google's Chromium security team rated the issue as Low severity. The vulnerability requires a pre-existing renderer compromise, which limits its standalone impact but makes it useful as part of a multi-stage exploit chain targeting the browser sandbox and same-origin boundary.

Critical Impact
An attacker controlling a compromised renderer process can bypass web origin policy enforcement in the Preload subsystem, enabling cross-origin data access from a crafted HTML page.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based builds incorporating the vulnerable Preload code path
Downstream browsers built on pre-152 Chromium releases

Discovery Timeline

2026-08-25 - CVE-2026-79184 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79184

Vulnerability Analysis

The vulnerability resides in Chrome's Preload feature, which is responsible for fetching and preparing resources before a navigation or subresource request completes. The Preload code path fails to enforce an authorization check tied to the web origin policy. When the renderer process is already under attacker control, this missing check allows the attacker to request or access resources that should be blocked by same-origin restrictions. The result is a bypass of a browser security boundary that normally isolates content from different web origins.

Exploitation is chained rather than direct. An attacker must first compromise the renderer through a separate vulnerability, such as a memory corruption bug in the JavaScript engine or a type confusion in Blink. Once inside the renderer, CVE-2026-79184 provides a mechanism to reach data across origin boundaries without needing to break the sandbox.

Root Cause

The root cause is a missing authorization check [CWE-862] in the Preload subsystem. Requests dispatched through this path do not consistently validate that the calling context is authorized to receive the resource under the web origin policy. Refer to Chromium Issue #497499482 for tracking details.

Attack Vector

The attack requires two conditions. First, the attacker must already control the renderer process, typically through a separate Chrome vulnerability. Second, the attacker delivers a crafted HTML page that triggers the vulnerable Preload path. The crafted page issues preload directives that the browser processes without the required origin authorization check. No user interaction beyond visiting attacker-controlled content is required once the renderer is compromised. See the Chrome Releases Update for vendor context.

No verified proof-of-concept code is available for this issue.
Refer to Chromium Issue #497499482 for restricted technical details
once access is granted by the Chromium security team.

Detection Methods for CVE-2026-79184

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 in enterprise inventories
Renderer processes exhibiting unexpected cross-origin resource fetches through preload requests
Outbound network activity from Chrome to attacker-controlled domains hosting crafted HTML preload payloads

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build prior to 152.0.7977.65.
Correlate browser telemetry with proxy logs to identify anomalous preload-driven cross-origin fetches.
Hunt for renderer process crashes or sandbox anomalies that may indicate a preceding renderer compromise required to reach this bug.

Monitoring Recommendations

Enable enterprise browser reporting through Chrome Enterprise policies to capture version and extension telemetry.
Forward browser and endpoint telemetry to a centralized data lake for retrospective hunting on Chromium CVE indicators.
Monitor for Chrome update failures on managed endpoints so out-of-date clients are surfaced quickly.

How to Mitigate CVE-2026-79184

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on all managed endpoints.
Restart Chrome after the update to ensure the patched binary is active.
Audit downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the fix.

Patch Information

Google addressed CVE-2026-79184 in Chrome Stable channel version 152.0.7977.65. Full release details are available in the Chrome Releases Update. Enterprises using Chrome Browser Cloud Management or group policy should force the update through their existing deployment channel.

Workarounds

No official workaround replaces patching; deploy 152.0.7977.65 or later as the primary remediation.
Reduce exposure to precursor renderer exploits by enforcing Site Isolation and disabling unnecessary browser extensions.
Restrict browsing to trusted sites for high-risk users until patching completes across the fleet.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Force update on managed Linux endpoints
sudo apt-get update && sudo apt-get install --only-upgrade google-chrome-stable