CVE-2026-79228: Google Chrome Site Isolation Bypass Vulnerability

CVE-2026-79228 Overview

CVE-2026-79228 is an incorrect authorization vulnerability [CWE-863] in the Site Isolation component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. An attacker who has already compromised the renderer process can bypass Site Isolation boundaries and reach a privileged page through a crafted HTML page. Google's Chromium team rated the security severity as Medium.

Site Isolation is a defense-in-depth boundary that separates web content across operating system processes. Bypassing this boundary weakens the sandbox model that Chrome relies on to contain compromised renderers.

Critical Impact
A remote attacker with a compromised renderer can escape Site Isolation and interact with a privileged Chrome page, expanding the impact of an initial browser-based compromise.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the same Site Isolation code path
Google Chrome on Windows, macOS, and Linux stable channel

Discovery Timeline

2026-08-25 - CVE-2026-79228 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in the NVD database

Technical Details for CVE-2026-79228

Vulnerability Analysis

The issue is an authorization check failure inside Chrome's Site Isolation logic. Site Isolation enforces that documents from different sites run in separate renderer processes and cannot access one another's data. It also protects privileged pages, such as internal chrome:// surfaces, from being reached by ordinary web content.

In vulnerable builds, the enforcement logic does not correctly authorize navigation or communication between a compromised renderer and a privileged page. An attacker who already controls a renderer process, typically after chaining a prior renderer bug, can craft an HTML page that causes Chrome to treat the request as authorized. The result is that the renderer reaches a privileged context it should never be able to touch.

Google addressed the flaw in Chrome 152.0.7977.65 on the stable desktop channel. The EPSS probability is 0.272%.

Root Cause

The root cause is an incorrect authorization decision [CWE-863] in Site Isolation. The affected code path fails to verify that the requesting renderer holds the privileges required to interact with a privileged page. Details are tracked in Chromium Issue Tracker #516398679.

Attack Vector

Exploitation requires two stages. First, the attacker must already have compromised the renderer process, usually through a separate memory corruption or logic bug in Chrome. Second, the attacker delivers a crafted HTML page that abuses the authorization gap to bypass Site Isolation into a privileged page.

This vulnerability is not a standalone entry point. It functions as a sandbox weakening primitive that increases the value of any working renderer exploit against Chrome.

No verified public exploit code is available. Refer to the Google Chrome Desktop Update advisory for vendor detail.

Detection Methods for CVE-2026-79228

Indicators of Compromise

Chrome renderer processes making unexpected navigations or IPC calls toward chrome:// privileged URLs
Endpoints running Chrome versions earlier than 152.0.7977.65 after the patch release window
Browser crash reports or chrome_debug.log entries referencing Site Isolation policy violations

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65
Monitor for anomalous child process activity spawned by chrome.exe following visits to untrusted sites
Correlate web proxy logs with endpoint telemetry to identify sessions that load crafted HTML pages before suspicious browser behavior

Monitoring Recommendations

Ingest browser and endpoint telemetry into a central analytics platform to correlate renderer anomalies with network activity
Alert on Chrome processes performing privileged operations shortly after loading external content
Track Chrome update compliance as a recurring security metric

How to Mitigate CVE-2026-79228

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update so the new binaries load in every user session
Audit Chromium-based browsers and embedded WebView components for equivalent fixes from their upstream vendors

Patch Information

Google released the fix in the stable desktop channel as documented in the Google Chrome Desktop Update advisory. Administrators should deploy Chrome 152.0.7977.65 or later through enterprise update tooling such as Google Update, Microsoft Intune, Jamf, or equivalent management platforms.

Workarounds

No official workaround replaces the patch; prioritize deployment of Chrome 152.0.7977.65 or later
Restrict user browsing to trusted sites through enterprise web filtering until patching is complete
Enforce least-privilege browser policies and disable unnecessary extensions to reduce renderer attack surface

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Verify installed Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: query the version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version