CVE-2026-79237 Overview
CVE-2026-79237 is an incorrect authorization vulnerability [CWE-863] in the Navigation component of Google Chrome prior to version 152.0.7977.65. A remote attacker can bypass the web origin policy by serving a crafted HTML page to a targeted user. Google's Chromium security team assigned this issue a Medium severity rating.
The flaw undermines the same-origin boundary that isolates content across web origins. Successful exploitation lets attacker-controlled pages interact with resources they should not be authorized to reach.
Critical Impact
A crafted HTML page can bypass web origin authorization checks during navigation, weakening the same-origin protections that separate untrusted web content from sensitive user data.
Affected Products
- Google Chrome for Desktop prior to 152.0.7977.65
- Chromium-based browsers that have not integrated the upstream Navigation fix
- Embedded browser components based on vulnerable Chromium builds
Discovery Timeline
- 2026-08-25 - CVE-2026-79237 published to the National Vulnerability Database
- 2026-08-26 - Last updated in the NVD database
Technical Details for CVE-2026-79237
Vulnerability Analysis
The vulnerability lives in Chrome's Navigation logic, which decides how a document, frame, or navigation request is associated with a security origin. Under specific conditions, the browser performs an authorization check that does not correctly evaluate the target origin before completing the navigation.
Because the web origin policy is the primary boundary between untrusted sites, an incorrect authorization decision in Navigation can allow one origin to influence, read, or act on content associated with another origin. Google classifies the issue as Medium severity, consistent with a same-origin policy bypass that still requires user interaction with attacker-controlled content.
Root Cause
The root cause is an incorrect authorization check [CWE-863] in the Navigation subsystem. The relevant code path accepts or promotes a navigation without fully validating the requester's authority over the destination origin. Public technical details are limited pending broader patch adoption. Refer to the Chromium Issue Tracker #499068536 for the upstream discussion.
Attack Vector
Exploitation is remote and requires the victim to load a crafted HTML page, typically by visiting a malicious site, opening an attacker-controlled link, or rendering hostile content inside an embedded browser view. No privileges are required on the target system.
Once the page loads, the attacker triggers the specific navigation sequence that fails the origin authorization check. This grants the attacker's page an authorization state it should not hold with respect to another origin. Public proof-of-concept code is not available at this time. See the Google Chrome Desktop Update advisory for vendor guidance.
Detection Methods for CVE-2026-79237
Indicators of Compromise
- Chrome browser instances reporting a version earlier than 152.0.7977.65 in enterprise inventory
- Outbound connections from user endpoints to unfamiliar domains immediately followed by cross-origin resource access patterns
- Unusual browser navigation chains involving frame or window references to sensitive internal web applications
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65.
- Monitor web proxy and DNS logs for user visits to newly registered or low-reputation domains that host active HTML content.
- Correlate browser process telemetry with subsequent access to internal web applications to identify anomalous cross-origin activity.
Monitoring Recommendations
- Enable browser version reporting through Chrome Enterprise policies and forward the data to your central logging platform.
- Alert on execution of Chrome binaries whose version string does not match the approved patched build.
- Track authentication events on internal web applications for unexpected cross-origin request patterns following user browsing sessions.
How to Mitigate CVE-2026-79237
Immediate Actions Required
- Update Google Chrome for Desktop to version 152.0.7977.65 or later on all managed endpoints.
- Restart Chrome after the update so the patched Navigation component is loaded into every browser process.
- Apply the corresponding upstream Chromium fix to any in-house or third-party Chromium-based browsers and embedded WebViews.
- Prioritize patching for users who routinely access sensitive internal web applications and identity providers.
Patch Information
Google addressed the issue in the Chrome Stable channel update to 152.0.7977.65. Details of the release are available in the Google Chrome Desktop Update announcement and the Chromium Issue Tracker #499068536. Enterprises using Chrome Enterprise policies should verify auto-update is enabled and confirm rollout completion through browser version reporting.
Workarounds
- No official workaround replaces the patch; upgrading Chrome is the supported remediation.
- Restrict browsing to trusted sites through enterprise URL allowlists until the patched version is deployed.
- Isolate high-risk browsing activity in a separate browser profile or remote browser isolation environment.
- Enforce site isolation and strict Content Security Policy headers on internal web applications to reduce the impact of an origin bypass.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
