CVE-2026-79191 Overview
CVE-2026-79191 is an incorrect authorization vulnerability [CWE-863] in the SiteIsolation component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass site isolation by leveraging social engineering with a crafted HTML page. Google classifies the Chromium security severity as Medium.
Site isolation is a core Chrome security boundary that keeps content from different sites in separate processes. Bypassing it undermines protections against cross-site data theft and sandbox-adjacent attacks.
Critical Impact
An attacker with renderer-process compromise can bypass site isolation and access cross-origin content, breaking a fundamental browser security boundary.
Affected Products
- Google Chrome for Desktop prior to 152.0.7977.65
- Chromium-based browsers that inherit the vulnerable SiteIsolation code
- Any downstream distribution embedding the affected Chromium version
Discovery Timeline
- 2026-08-25 - CVE-2026-79191 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79191
Vulnerability Analysis
The vulnerability resides in Chrome's SiteIsolation enforcement logic. Site isolation places pages from different sites into separate renderer processes to prevent cross-origin data access. This flaw is an authorization check failure [CWE-863] where the browser does not correctly validate that a compromised renderer is permitted to access certain cross-site resources.
Exploitation is not fully remote on its own. It requires two conditions: prior compromise of the renderer process and a user tricked into interacting with a crafted HTML page. The social-engineering requirement lowers the practical severity but does not eliminate the risk in targeted attack chains.
A successful bypass allows the attacker to reach content or capabilities that the site isolation boundary is designed to protect. This can be chained with other renderer or sandbox exploits to expand impact.
Root Cause
The root cause is improper authorization within the site isolation enforcement path. The affected logic accepts requests or navigations without correctly verifying that the requesting renderer is authorized for the target site context.
Attack Vector
The attack requires an attacker-controlled renderer, achieved through a prior exploit, plus user interaction with a malicious HTML page. The attacker then serves crafted markup that triggers the misauthorization path in SiteIsolation, allowing cross-site access from the compromised renderer. Full technical details are tracked in the Chromium Issue Tracker #517606780.
No public proof-of-concept exploit code is available. The EPSS probability for this CVE is low, consistent with the compound preconditions required for exploitation.
Detection Methods for CVE-2026-79191
Indicators of Compromise
- Chrome browser processes running versions earlier than 152.0.7977.65 in enterprise environments
- Unexpected cross-origin data access patterns originating from renderer processes
- User reports of suspicious HTML pages requesting unusual permissions or interactions preceding anomalous browser behavior
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65
- Monitor endpoint telemetry for anomalous child processes spawned by chrome.exe or renderer processes exhibiting unexpected network activity
- Correlate phishing or social-engineering indicators with subsequent browser process anomalies to identify attempted exploitation chains
Monitoring Recommendations
- Track Chrome update compliance through endpoint management tooling and alert on stale versions
- Log and review outbound connections initiated by Chrome renderer processes for cross-site anomalies
- Enable browser telemetry and enterprise reporting features to surface crash and security events tied to site isolation
How to Mitigate CVE-2026-79191
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
- Enforce automatic browser updates through group policy or mobile device management
- Communicate phishing and social-engineering awareness guidance to users, since exploitation requires user interaction with a crafted page
Patch Information
Google addressed CVE-2026-79191 in Chrome Stable 152.0.7977.65. Refer to the Google Chrome Stable Update announcement for release details and the Chromium Issue Tracker #517606780 for the underlying issue.
Workarounds
- No vendor-supplied workaround exists. Apply the vendor patch as the primary remediation.
- Restrict browsing to trusted sites through enterprise policy where feasible until patching is complete
- Deploy web filtering and phishing protection to reduce exposure to crafted HTML pages hosting exploit content
# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString
# Verify installed Chrome version on Linux
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
