CVE-2026-79192: Google Chrome Auth Bypass Vulnerability

CVE-2026-79192 Overview

CVE-2026-79192 is an improper input validation vulnerability [CWE-20] in the Variations component of Google Chrome. Versions prior to 152.0.7977.65 are affected. A remote attacker can send crafted network traffic to potentially bypass Chrome's web origin policy. Google has rated the Chromium security severity as Medium.

The flaw affects Chrome's Variations service, which delivers field trial and feature configuration data to browser clients. Bypassing the web origin policy weakens the same-origin boundary that isolates content between web sites.

Critical Impact
Remote attackers can bypass the web origin policy through crafted network traffic, potentially exposing cross-origin data or enabling further browser-based attacks.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers that consume the same Variations code path
Enterprise Chrome deployments on Windows, macOS, and Linux prior to the fixed build

Discovery Timeline

2026-08-25 - CVE-2026-79192 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79192

Vulnerability Analysis

The vulnerability resides in Chrome's Variations subsystem, which fetches and applies experiment and feature-flag configurations. Improper validation of input delivered to this component allows a remote attacker to influence browser state in ways that undermine origin isolation.

Web origin policy enforcement is the foundation of browser security. When it can be bypassed, one origin may read or interact with resources belonging to another origin. This class of flaw is tracked as CWE-20: Improper Input Validation.

The attacker does not need local access. Delivery through network-borne content is sufficient to trigger the condition. Google has not published exploitation details, consistent with Chrome's practice of withholding technical specifics until the patched build reaches broad distribution.

Root Cause

The root cause is missing or insufficient validation of untrusted input processed by the Variations component. Chrome accepts data that should have been rejected or normalized, and downstream logic then makes origin-relevant decisions based on that unvalidated data.

Attack Vector

Exploitation occurs over the network through crafted traffic reaching the Variations code path. A successful attack degrades same-origin enforcement in the browser session and may enable follow-on cross-origin data access or scripting attacks against the victim. Refer to the Chromium Issue Tracker entry #502082953 and the Google Chrome Stable Update advisory for vendor context.

Detection Methods for CVE-2026-79192

Indicators of Compromise

Chrome installations reporting a version below 152.0.7977.65 in enterprise inventory data.
Unexpected outbound connections from chrome.exe to non-Google hosts during Variations seed fetches.
Browser telemetry showing anomalous cross-origin reads or navigations that would normally be blocked by same-origin policy.

Detection Strategies

Inventory browser versions across managed endpoints and flag hosts running Chrome builds older than 152.0.7977.65.
Monitor endpoint process telemetry for Chrome renderer or network service crashes correlated with unusual network activity.
Correlate web proxy logs with browser version data to identify vulnerable clients receiving untrusted content.

Monitoring Recommendations

Ingest browser version and update status into a centralized data lake for continuous compliance checks.
Alert on Chrome auto-update failures that leave endpoints on outdated builds.
Track requests to the Chrome Variations service endpoints and investigate anomalous responses or interception attempts.

How to Mitigate CVE-2026-79192

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update to ensure the patched binaries are loaded into memory.
Verify update deployment through enterprise management tooling and remediate any endpoints that failed to update.

Patch Information

Google addressed CVE-2026-79192 in the Stable channel release documented in the Google Chrome Stable Update advisory. The fix ships in Chrome 152.0.7977.65 and later. Chromium-based browsers should apply the corresponding upstream fix once their vendors incorporate it.

Workarounds

No official workaround exists. Applying the patched Chrome build is the only supported remediation.
Restrict user browsing to trusted sites through enterprise policy until updates are deployed.
Use network egress controls to limit exposure of unpatched clients to untrusted content.

bash

# Verify Chrome version on managed endpoints
# Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Force update via enterprise policy (Windows registry)
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f