CVE-2026-79212: Google Chrome Auth Bypass Vulnerability

CVE-2026-79212 Overview

CVE-2026-79212 is a missing authorization vulnerability [CWE-862] in the Passwords component of Google Chrome versions prior to 152.0.7977.65. The flaw allows a remote attacker who has already compromised the renderer process to bypass web origin policy through a crafted HTML page combined with social engineering. Chromium classifies the security severity as High. Successful exploitation gives an attacker cross-origin access to stored password data that would normally be isolated by the browser's same-origin policy.

Critical Impact
An attacker with a compromised renderer process can bypass origin isolation in the Passwords subsystem and access credentials tied to other web origins, enabling credential theft and account takeover.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based builds incorporating the pre-patch Passwords component
Downstream Chromium browsers that have not merged the upstream fix

Discovery Timeline

2026-08-25 - CVE-2026-79212 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in the NVD database

Technical Details for CVE-2026-79212

Vulnerability Analysis

The vulnerability is a missing authorization issue in Chrome's Passwords feature. Chrome enforces the web origin policy to keep credentials scoped to the site that stored them. In vulnerable builds, the Passwords component does not adequately validate that the caller is authorized to act on a given origin's credentials once the renderer process has been compromised. An attacker who has already achieved code execution inside a renderer can issue requests that the Passwords subsystem services without an authorization check tied to the target origin.

Exploitation is not fully remote on its own. It requires two preconditions: prior compromise of the renderer process and user interaction driven by social engineering delivered through a crafted HTML page. This chained requirement is reflected in the Chromium High severity rating rather than Critical.

Root Cause

The root cause is a missing authorization check [CWE-862] in the Passwords component's boundary handling. The code path that responds to credential-related requests does not enforce that the requesting context matches the origin owning the credential. This breaks the trust boundary that the web origin policy is intended to guarantee for stored passwords.

Attack Vector

The attack chain begins with a separate renderer compromise, typically leveraging a memory corruption or type confusion bug. From inside the compromised renderer, the attacker serves a crafted HTML page and uses social engineering to induce user interaction. The Passwords component then processes the request without confirming origin authorization, disclosing or acting on credentials belonging to other web origins. See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for vendor details.

No verified proof-of-concept code is publicly available. The vulnerability mechanism is described in prose above without synthetic exploitation examples.

Detection Methods for CVE-2026-79212

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 in enterprise inventory
Renderer process crashes or unexpected child-process spawns preceding password autofill events
Outbound requests from browser hosts containing credential material to domains not visited by the user
HTML content served from untrusted origins that references password manager or autofill APIs in unusual sequences

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65
Correlate browser process telemetry with subsequent authentication events at monitored SaaS applications to identify anomalous credential reuse
Alert on renderer sandbox escapes or crashes that occur in temporal proximity to social-engineering indicators such as phishing lures

Monitoring Recommendations

Ingest Chrome update and version telemetry into the SIEM to track patch compliance over time
Monitor identity providers for logins from new devices or geographies immediately following user interaction with untrusted pages
Track DNS and proxy logs for connections to domains flagged as credential-harvesting infrastructure

How to Mitigate CVE-2026-79212

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on every managed endpoint
Force browser restarts through endpoint management to ensure the patched binary is loaded
Audit password manager usage and reset credentials for users who interacted with suspicious pages before patching

Patch Information

Google addressed CVE-2026-79212 in the Chrome Stable channel with version 152.0.7977.65. Details are documented in the Google Chrome Stable Update release note and the corresponding Chromium Issue Tracker Entry. Downstream Chromium-based browsers must merge the upstream fix and ship an updated build to remediate the flaw.

Workarounds

Enforce Chrome auto-update via enterprise policy so that stable channel patches deploy without user action
Disable the built-in password manager through the PasswordManagerEnabled enterprise policy where a third-party credential manager is in use
Deliver targeted phishing and social-engineering awareness training focused on browser prompts and credential dialogs
Restrict browsing to categorized destinations using a secure web gateway to reduce exposure to attacker-controlled HTML

bash

# Configuration example: enforce Chrome minimum version and disable in-browser password manager via enterprise policy (Linux JSON policy)
cat >/etc/opt/chrome/policies/managed/cve-2026-79212.json <<'EOF'
{
  "PasswordManagerEnabled": false,
  "ComponentUpdatesEnabled": true,
  "DefaultBrowserSettingEnabled": true
}
EOF