CVE-2026-79190: Google Chrome Authorization Bypass Vulnerability

CVE-2026-79190 Overview

CVE-2026-79190 is an incorrect authorization vulnerability in the Extensions component of Google Chrome prior to version 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass the web origin policy by serving a crafted HTML page. Chromium's security team rated the underlying issue as Low severity. The weakness maps to CWE-863: Incorrect Authorization.

Critical Impact
An attacker with a compromised renderer can circumvent same-origin protections in the Extensions subsystem, expanding the reach of an existing browser exploit chain.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers that inherit the vulnerable Extensions authorization logic
Enterprise Chrome deployments not yet updated to the current Stable channel

Discovery Timeline

2026-08-25 - CVE-2026-79190 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79190

Vulnerability Analysis

The defect lives in Chrome's Extensions subsystem, where authorization decisions do not correctly enforce the web origin policy. When a renderer process is already compromised, the extensions authorization path fails to reject cross-origin operations initiated from a crafted HTML page. This bypass extends the attacker's control beyond the origin boundary the renderer should be constrained to.

The issue is classified under CWE-863: Incorrect Authorization. Successful exploitation requires an existing renderer compromise, so this bug functions as a chained escalation primitive rather than a standalone entry point. Refer to the Chromium Issue Report #513172858 for tracking details.

Root Cause

The root cause is an authorization check in the Extensions code path that does not correctly validate the requesting origin against the target resource. Because the check is incorrect rather than missing, requests that should be denied under the same-origin policy are permitted when routed through a compromised renderer.

Attack Vector

Exploitation requires two conditions. First, the attacker must already control a renderer process, typically through a separate memory corruption or logic bug. Second, the attacker delivers a crafted HTML page that triggers the flawed authorization path in the Extensions component. The result is a web origin policy bypass that expands the compromised renderer's reach.

No standalone remote exploit exists based on public data. No proof-of-concept has been published, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-79190

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 in environments that permit third-party extension installation.
Renderer processes making unexpected cross-origin requests to extension-controlled resources or APIs.
Anomalous extension activity following the load of untrusted HTML content, particularly from newly visited domains.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65.
Correlate browser process telemetry with network egress to identify renderer processes issuing requests inconsistent with the loaded page origin.
Monitor extension install, update, and permission-change events for unmanaged or recently sideloaded extensions.

Monitoring Recommendations

Enable endpoint telemetry for Chrome child processes and record command lines, parent-child relationships, and network connections.
Alert on Chrome crash reports or renderer terminations that precede unusual extension behavior, which can indicate an exploit chain in progress.
Track Chrome Stable channel release notes such as the Google Chrome Stable Update and correlate against your deployed versions.

How to Mitigate CVE-2026-79190

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later across all managed endpoints.
Force a browser restart after the update so that the patched binaries replace running processes.
Audit installed extensions and remove any that are unnecessary, unmanaged, or sourced from outside the Chrome Web Store.

Patch Information

Google released the fix in Chrome Stable 152.0.7977.65. Details are published in the Google Chrome Stable Update and the Chromium Issue Report #513172858. Chromium-based browsers should apply their vendor's corresponding update once available.

Workarounds

Enforce Chrome auto-update through enterprise policy so that Stable channel patches deploy without user interaction.
Restrict extension installation to an allowlist using the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies.
Disable unneeded extensions in high-risk user populations until patch coverage is verified.

bash

# Example Chrome enterprise policy (Linux managed policy JSON)
# Restricts extensions to an explicit allowlist and blocks all others
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "ExtensionSettings": {
    "*": {
      "installation_mode": "blocked"
    }
  }
}