CVE-2026-79199: Google Chrome Auth Bypass Vulnerability

CVE-2026-79199 Overview

CVE-2026-79199 is an incorrect authorization vulnerability [CWE-863] in the Network component of Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to bypass system access restrictions by serving a crafted HTML page to a targeted user. Chromium classifies the security severity as Medium. Successful exploitation requires the victim to load attacker-controlled web content, at which point the browser fails to properly enforce access checks in the network stack.

Critical Impact
A remote attacker can bypass system access restrictions in Chrome's network layer by luring a user to a crafted HTML page, undermining browser-enforced security boundaries.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers that ship the vulnerable Network component
Downstream distributions that embed the affected Chromium build

Discovery Timeline

2026-08-25 - CVE-2026-79199 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79199

Vulnerability Analysis

The flaw resides in the Network component of Chrome and is categorized as incorrect authorization [CWE-863]. The browser performs an access decision that does not adequately validate the requesting context against the resource being accessed. As a result, a remote page can trigger network operations that should be blocked by the browser's security model.

Because the defect is reachable through standard web content, no local access or elevated privileges are required for an attacker to attempt exploitation. The victim only needs to visit or be redirected to a page under attacker control.

Root Cause

The underlying defect is an authorization check that fails to correctly validate the origin, scheme, or capability associated with a network request. Chrome's network stack applies rules that enforce boundaries between web origins and system-level resources. When those rules are evaluated incorrectly, restricted operations become reachable from ordinary web contexts.

Attack Vector

An attacker hosts a crafted HTML page and delivers it to the victim through direct navigation, a phishing link, a compromised site, or a malicious advertisement. When the page loads, JavaScript and HTML constructs interact with the affected network paths in Chrome. The incorrect authorization check permits the request to proceed and bypasses the intended system access restriction. Full technical details are restricted; see the Chromium Issue Tracker #513719741 and the Google Chrome Stable Update for vendor references.

Detection Methods for CVE-2026-79199

Indicators of Compromise

Chrome browser processes on endpoints reporting version strings earlier than 152.0.7977.65 after the patch release window.
Outbound HTTP or HTTPS requests from browser processes to unfamiliar domains immediately after users visit newly seen URLs.
Browser-originated network traffic targeting internal resources or non-standard ports that would normally be blocked by same-origin or private network access rules.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65.
Correlate web proxy logs with endpoint telemetry to identify users who loaded suspicious HTML pages preceding anomalous internal requests.
Monitor for browser child processes performing network activity that does not match typical user browsing patterns.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake to enable retroactive hunting once additional indicators are published.
Track vendor advisories on the Google Chrome Releases blog for related fixes and updated version pins.
Alert on Chrome update failures or version drift on managed devices, since unpatched hosts remain exposed.

How to Mitigate CVE-2026-79199

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Force-restart Chrome after the update so the patched binary is loaded into memory.
Verify that Chromium-based browsers and embedded WebView components in enterprise applications have received the corresponding upstream fix.

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Update. Administrators should confirm that endpoint management policies allow Chrome auto-update or push the fixed version through enterprise deployment tooling.

Workarounds

Restrict user browsing to trusted sites through web proxy policies until all endpoints report the fixed version.
Enforce private network access and same-origin policies at the network perimeter to reduce the impact of browser-side authorization gaps.
Educate users to avoid unsolicited links until patch deployment is verified across the fleet.

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version
# Expected output should be: Google Chrome 152.0.7977.65 or later