CVE-2026-79186: Google Chrome Auth Bypass Vulnerability

CVE-2026-79186 Overview

CVE-2026-79186 is an incorrect authorization vulnerability [CWE-863] in the Network component of Google Chrome. The flaw exists in versions prior to 152.0.7977.65 and allows a remote attacker who has already compromised the renderer process to bypass site isolation. Exploitation requires a crafted HTML page delivered to the target. Google's Chromium team rated the security severity as Medium.

Site isolation is a core browser security boundary that keeps content from different origins in separate processes. Bypassing this boundary undermines cross-origin protections that Chrome relies on to contain compromised renderers.

Critical Impact
A remote attacker with a compromised renderer process can bypass Chrome's site isolation boundary using a crafted HTML page, exposing cross-origin data that should remain isolated.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based builds incorporating the vulnerable Network component
Downstream Chromium browsers that had not yet merged the upstream fix

Discovery Timeline

2026-08-25 - CVE-2026-79186 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79186

Vulnerability Analysis

The vulnerability resides in Chrome's Network component and is classified as incorrect authorization [CWE-863]. Chrome enforces site isolation by ensuring each site runs in a dedicated renderer process. The Network service validates that a given renderer is authorized to request or receive resources for a specific origin. In vulnerable versions, that authorization check does not fully enforce the site isolation boundary.

An attacker who has already compromised a renderer, typically through a separate memory corruption or logic flaw, can leverage this weakness. The compromised renderer can obtain or influence network resources tied to origins it should not have access to. The Chromium project tracks the fix under Chromium Issue #497646947.

Root Cause

The root cause is an authorization check in the Network component that does not correctly bind requests to the site the renderer is authorized to represent. Because the check is incomplete, requests originating from a compromised renderer can be attributed to an origin the renderer does not legitimately host.

Attack Vector

Exploitation is a two-stage attack. First, the attacker must compromise a renderer process, generally by chaining an earlier browser vulnerability. Second, the attacker delivers a crafted HTML page that triggers the flawed authorization path in the Network component. Successful exploitation lets the attacker read or influence data from other sites that share the browser session, defeating the primary containment guarantee of site isolation. See the Google Chrome Stable Update for the fixed version.

Detection Methods for CVE-2026-79186

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 in the enterprise fleet
Unexpected cross-origin network requests originating from renderer processes that do not match the tab's active site
Renderer child processes spawning or communicating with unusual endpoints shortly after visiting untrusted pages

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds below 152.0.7977.65
Correlate browser process telemetry with outbound network flows to detect renderers accessing origins outside their expected site
Hunt for anomalous child process activity linked to chrome.exe following visits to attacker-controlled pages

Monitoring Recommendations

Ingest endpoint browser telemetry and DNS logs into a centralized data lake for cross-source correlation
Alert on Chrome installations that fall behind the current stable channel for more than one release cycle
Monitor for renderer processes exhibiting unusual memory, IPC, or network patterns consistent with post-exploitation behavior

How to Mitigate CVE-2026-79186

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Restart browser sessions after patching to ensure the updated binary is loaded
Audit downstream Chromium-based browsers and apply their corresponding updates that include the upstream fix

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Update announcement. The corresponding tracking record is Chromium Issue #497646947. Administrators should push the update through enterprise management tooling and validate deployment coverage.

Workarounds

Restrict browsing on high-value endpoints to trusted sites until the patch is deployed
Enforce enterprise policies that block execution of untrusted extensions and reduce renderer attack surface
Segment browser use for sensitive workflows onto managed profiles with strict content and script controls

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Verify installed Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version