CVE-2026-79238: Chrome ServiceWorker Auth Bypass Vulnerability

CVE-2026-79238 Overview

CVE-2026-79238 is an incorrect authorization vulnerability [CWE-863] in the ServiceWorker component of Google Chrome. Versions prior to 152.0.7977.65 fail to properly enforce web origin policy when handling requests originating from Chrome extensions. A remote attacker who convinces a user to install a crafted extension can bypass same-origin restrictions and access resources across web origins. Google has classified the Chromium security severity as Medium. Exploitation requires social engineering, since the attacker must persuade a target to install the malicious extension. The Exploit Prediction Scoring System (EPSS) lists the probability at 0.174% as of 2026-08-27.

Critical Impact
A crafted Chrome extension can bypass the web origin policy through the ServiceWorker component, enabling unauthorized cross-origin access to user data and sessions.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers that share the vulnerable ServiceWorker implementation
Chrome extension runtime environments on all supported desktop platforms

Discovery Timeline

2026-08-25 - CVE-2026-79238 published to the National Vulnerability Database
2026-08-26 - Last updated in the NVD database

Technical Details for CVE-2026-79238

Vulnerability Analysis

The flaw resides in how Chrome's ServiceWorker enforces authorization checks when handling requests initiated by extensions. ServiceWorkers act as programmable network proxies for web pages. They intercept fetch events, cache responses, and mediate access between web origins. Chrome extensions run with elevated privileges and can register ServiceWorkers or interact with existing ones. The vulnerability arises because the ServiceWorker authorization path does not correctly validate the origin context when an extension is involved in the request chain. This gap allows a crafted extension to invoke ServiceWorker behavior that reaches across the web origin boundary, breaking the isolation model that separates one site's data from another.

Root Cause

The defect is an authorization decision made against insufficient origin context [CWE-863]. When a ServiceWorker fetch or message dispatch originates from an extension, the authorization layer does not confirm that the target origin matches the origin permitted by the extension manifest and the web origin policy. Instead, the request proceeds under weaker checks, letting extension-mediated calls read or influence resources belonging to unrelated origins.

Attack Vector

Exploitation requires user interaction driven by social engineering. The attacker publishes or delivers a Chrome extension that appears benign and convinces the victim to install it. Once installed, the extension issues requests that route through the ServiceWorker layer and exploit the incorrect authorization check to reach protected origins. The attacker can then interact with authenticated sessions on those origins from the victim's browser. Because no verified proof-of-concept code is publicly available, defenders should refer to the Google Chrome Update Announcement and the Chromium Issue Tracker Entry for authoritative technical details.

Detection Methods for CVE-2026-79238

Indicators of Compromise

Installation of Chrome extensions from outside the official Chrome Web Store or from low-reputation publishers
Extensions requesting broad host permissions such as <all_urls> combined with ServiceWorker registration
Unexpected outbound requests from browser processes to attacker-controlled domains following extension installation
Anomalous cross-origin fetches or cache activity generated by the browser's ServiceWorker component

Detection Strategies

Inventory installed Chrome extensions on managed endpoints and compare against an approved list
Monitor Chrome version telemetry to identify hosts running versions earlier than 152.0.7977.65
Correlate extension installation events with subsequent authenticated session activity on sensitive web applications
Review browser process network telemetry for cross-origin patterns inconsistent with normal user browsing

Monitoring Recommendations

Enable enterprise reporting through Chrome Browser Cloud Management to capture extension inventory and version data
Forward endpoint browser telemetry into a centralized data lake for longitudinal analysis of extension behavior
Alert on Chrome extension permission changes and new ServiceWorker registrations from non-approved sources
Track user-reported prompts to install browser extensions as a leading indicator of social engineering campaigns

How to Mitigate CVE-2026-79238

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Audit installed Chrome extensions and remove any that are unapproved, unsigned, or from unverified publishers
Restrict extension installation to an allowlist enforced through the ExtensionInstallAllowlist policy
Communicate the social engineering risk to users and reinforce guidance on rejecting unsolicited extension prompts

Patch Information

Google released the fix in Chrome 152.0.7977.65 on the Stable channel. Deploy the update through managed update channels, enterprise MSI packages, or the built-in Chrome updater. Confirm remediation by checking chrome://version on representative endpoints. See the Google Chrome Update Announcement and the Chromium Issue Tracker Entry for release details.

Workarounds

Block installation of all extensions using ExtensionInstallBlocklist set to * where extensions are not business-critical
Force-install only vetted extensions through ExtensionInstallForcelist and disallow user-added extensions
Disable developer mode extensions on managed browsers to prevent sideloading of crafted packages
Use browser isolation for high-risk browsing activity until all endpoints are patched

bash

# Configuration example: Chrome enterprise policy restricting extensions (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f
reg add "HKLM\Software\Policies\Google\Chrome\DeveloperToolsAvailability" /v 1 /t REG_DWORD /d 2 /f