CVE-2026-79205: Google Chrome Auth Bypass Vulnerability

CVE-2026-79205 Overview

CVE-2026-79205 is an incorrect authorization vulnerability in the Network component of Google Chrome prior to version 152.0.7977.65. A remote attacker can bypass the web origin policy by serving a crafted HTML page to a targeted user. Chromium rates the security severity as Medium. The flaw is classified under CWE-863: Incorrect Authorization and undermines the same-origin boundary that isolates web content across sites.

Critical Impact
Attackers can bypass browser-enforced origin restrictions to access cross-origin resources through a crafted HTML page, exposing user data across site boundaries.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers sharing the affected Network component code
Downstream Chromium derivatives pending vendor updates

Discovery Timeline

2026-08-25 - CVE-2026-79205 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79205

Vulnerability Analysis

The vulnerability resides in the Network component of Chromium. The component fails to correctly enforce authorization checks tied to the web origin policy. As a result, a crafted HTML page can trigger network operations that should be blocked by same-origin restrictions. Chromium classifies the issue as CWE-863, which covers cases where authorization logic is present but applied incorrectly.

Bypassing web origin controls exposes cross-origin resources that browsers are designed to keep isolated. This can facilitate data disclosure across sites, tampering with authenticated sessions, or interaction with resources that should require distinct origin permissions. The Chromium Issue Tracker #518065628 contains restricted implementation details that are typically embargoed until broader patch adoption.

Root Cause

The defect stems from incorrect authorization logic within Chromium's network stack. Specific origin checks either evaluate the wrong context or are skipped along a code path reachable through crafted HTML content. The full patch details are referenced in the Google Chrome Stable Update announcement.

Attack Vector

A remote attacker hosts a crafted HTML page and induces a victim to load it, typically through phishing, malvertising, or a compromised site. When the browser processes the page, the Network component performs actions that violate the intended origin boundary. No authentication is required by the attacker, and interaction is limited to visiting a page. Verified proof-of-concept code is not publicly available at this time.

Detection Methods for CVE-2026-79205

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 in enterprise inventory scans.
Outbound requests from browser processes to unexpected cross-origin endpoints inconsistent with user navigation.
Web server logs showing cross-origin requests that carry unexpected credential material or headers.

Detection Strategies

Inventory Chrome installations across managed endpoints and flag any build below 152.0.7977.65.
Monitor browser telemetry for anomalous cross-origin fetch and XHR patterns that deviate from user session baselines.
Correlate URL categorization data with endpoint browser process activity to surface visits to newly registered or low-reputation domains hosting suspicious HTML content.

Monitoring Recommendations

Ingest browser process telemetry and proxy logs into a centralized analytics platform for retroactive hunting after patch release.
Alert on high-risk file downloads or credential submissions initiated shortly after visiting uncategorized domains.
Track Chrome auto-update compliance metrics to identify endpoints that stall on outdated builds.

How to Mitigate CVE-2026-79205

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Verify that Chrome auto-update is enabled and functioning through enterprise management policies.
Restart browser sessions after the update to ensure the patched Network component is loaded.

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Update announcement. Enterprises should push the update through their existing software distribution channels and confirm receipt across roaming endpoints. Chromium-based browsers should apply vendor updates that incorporate the upstream fix.

Workarounds

Restrict browsing to trusted sites via enterprise web filtering until patches are deployed.
Enforce strict site isolation policies through Chrome enterprise configuration to limit cross-origin data exposure.
Use network egress controls to block access to newly observed or low-reputation domains that could host exploit pages.

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows PowerShell version check
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Expected output: 152.0.7977.65 or higher