CVE-2026-79201: Google Chrome Workers Auth Bypass Flaw

CVE-2026-79201 Overview

CVE-2026-79201 is an improper access control vulnerability [CWE-284] in the Workers component of Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to bypass web origin policy through a crafted HTML page. Google's Chromium team assigned this issue a Medium security severity rating.

The flaw affects how Chrome enforces same-origin restrictions on Worker threads. An attacker who lures a user to a malicious page can violate the boundary that separates web origins. This undermines a core browser security guarantee that isolates content between sites.

Critical Impact
A crafted HTML page can bypass the web origin policy in Chrome Workers, exposing cross-origin data and enabling client-side attacks against authenticated web sessions.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers that inherit the Workers implementation from upstream Chromium
Downstream distributions embedding the vulnerable Chromium release channel

Discovery Timeline

2026-08-25 - CVE-2026-79201 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79201

Vulnerability Analysis

The vulnerability resides in Chrome's Workers subsystem, which includes Web Workers, Shared Workers, and Service Workers. These background execution contexts must strictly adhere to the same-origin policy that governs web content. The defect allows a remote attacker to circumvent that policy through specifically crafted HTML.

When the origin policy is bypassed, a Worker created from an attacker-controlled page may interact with resources belonging to another origin. This breaks the isolation model on which authenticated web applications depend. The impact class is improper access control, aligned with [CWE-284].

Exploitation requires user interaction, since the victim must load the crafted HTML page in an affected Chrome build. No additional privileges or authentication are needed on the attacker side. The EPSS model rates this CVE with a probability of 0.242% at the time of publication.

Root Cause

The root cause is missing or incorrect origin enforcement during Worker context establishment or message handling. The Workers implementation fails to validate the security origin under specific conditions triggered by attacker-controlled HTML markup. Public technical details beyond the Chromium issue tracker entry 513836495 are restricted while patch adoption progresses.

Attack Vector

The attack vector is a crafted HTML page delivered via a website, malvertising, phishing link, or embedded iframe. When the victim loads the page in a vulnerable Chrome version, the Worker created by the page evades the same-origin check. The attacker can then access, exfiltrate, or manipulate data associated with a different web origin the user is authenticated to.

Technical exploitation details are described in the Chromium Issue Tracker #513836495 once access restrictions are lifted. No public proof-of-concept code is available at this time.

Detection Methods for CVE-2026-79201

Indicators of Compromise

Chrome browser processes at versions earlier than 152.0.7977.65 present on managed endpoints
Outbound requests from browser Worker contexts to unexpected third-party domains following user navigation to untrusted sites
Unexpected cross-origin data reads observed in web application server logs from authenticated user sessions
Suspicious HTML content served with heavy use of Worker, SharedWorker, or ServiceWorker registrations from newly registered domains

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65 as vulnerable
Monitor web proxy and DNS telemetry for user browsing sessions that visit uncategorized domains immediately before anomalous cross-origin API traffic
Correlate authentication events with browser telemetry to identify session activity that does not match user-driven navigation patterns
Alert on installation of Chrome extensions or PWAs that register Service Workers from low-reputation origins

Monitoring Recommendations

Ingest browser version data and web proxy logs into a centralized analytics platform for continuous exposure tracking
Track Chrome release channel adoption metrics to confirm the 152.0.7977.65 patch is deployed within the organization's SLA
Watch for Chromium security advisory updates referencing the Workers component in subsequent stable channel releases

How to Mitigate CVE-2026-79201

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binary is loaded on every user session
Audit Chromium-based browsers such as Microsoft Edge, Brave, and Opera for corresponding vendor patches that incorporate the upstream fix
Prioritize patching on systems used to access high-value web applications, identity portals, and administrative consoles

Patch Information

Google addressed CVE-2026-79201 in the Chrome Stable channel release documented in the Google Chrome Stable Update announcement. Administrators should confirm the deployed build reports as 152.0.7977.65 or a later version. Enterprise deployments using Chrome Browser Cloud Management or group policy should force the update through managed channels.

Workarounds

Enforce Chrome auto-update policies through enterprise management to eliminate stale versions
Restrict browsing to categorized business domains via web proxy or Secure Web Gateway policy until patching completes
Use browser isolation for high-risk users accessing untrusted external content during the remediation window

bash

# Verify installed Chrome version on Linux and macOS
google-chrome --version

# Windows: query registry for installed Chrome version
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force update via enterprise policy (Windows Group Policy)
# Set: Computer Configuration > Administrative Templates > Google > Google Update > Applications
# Policy: Update policy override > Always allow updates