CVE-2026-79243: Google Chrome Auth Bypass Vulnerability

CVE-2026-79243 Overview

CVE-2026-79243 is an improper input validation vulnerability [CWE-20] in the ReadingList component of Google Chrome on Windows. The flaw affects Chrome versions prior to 152.0.7977.65 and allows a remote attacker who has already compromised the renderer process to bypass web origin policy through a crafted HTML page. Chromium's internal security severity rating for this issue is Low, while the NVD assigns a medium score reflecting the integrity impact of a same-origin policy bypass.

Critical Impact
An attacker with control of the renderer process can violate origin isolation, enabling cross-origin data tampering through a malicious HTML page.

Affected Products

Google Chrome on Windows prior to 152.0.7977.65
Microsoft Windows (host operating system)
Chromium-based browsers that inherit the ReadingList implementation

Discovery Timeline

2026-08-25 - CVE-2026-79243 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79243

Vulnerability Analysis

The vulnerability resides in Chrome's ReadingList feature, which lets users save pages for later reading. The component fails to properly validate input passed from the renderer process. An attacker who has already achieved code execution inside the sandboxed renderer can leverage this weakness to bypass the web origin policy. This weakens the security boundary that keeps content from one origin isolated from another.

Exploitation requires a prior renderer compromise, which is why Chromium classifies the issue as Low severity. In a chained attack, the flaw serves as a secondary primitive that expands the impact of an initial renderer bug. The confidentiality impact is rated none, but integrity impact is rated high because attackers can manipulate cross-origin data. User interaction is required, typically by luring a victim to a crafted HTML page.

Root Cause

The root cause is missing or insufficient validation of data flowing from the renderer to the ReadingList browser-process handler. The trust boundary between the renderer and browser process is not enforced strictly enough, allowing renderer-supplied input to influence origin decisions in the ReadingList subsystem.

Attack Vector

The attack vector is network-based and requires user interaction. A remote attacker hosts a crafted HTML page, compromises the renderer through a separate vulnerability, and then abuses the ReadingList validation gap to bypass same-origin protections. See the Chromium Issue Tracker #517394060 for technical context. No public proof-of-concept code is available for this CVE at the time of publication.

Detection Methods for CVE-2026-79243

Indicators of Compromise

Chrome installations reporting versions earlier than 152.0.7977.65 on Windows endpoints
Unexpected ReadingList entries or ReadingList sync activity tied to unfamiliar origins
Renderer process crashes or anomalous child-process spawns preceding cross-origin data access

Detection Strategies

Inventory browser versions across the fleet and flag Chrome builds below 152.0.7977.65 on Windows
Correlate renderer process anomalies with subsequent access to cross-origin resources in browser telemetry
Monitor for delivery of suspicious HTML content through email gateways, web proxies, and DNS logs

Monitoring Recommendations

Track outbound connections from chrome.exe child processes to newly registered or low-reputation domains
Alert on Chrome update failures that keep endpoints on vulnerable versions
Review browser crash reports and Windows Error Reporting entries associated with the renderer process

How to Mitigate CVE-2026-79243

Immediate Actions Required

Update Google Chrome on Windows to version 152.0.7977.65 or later across all managed endpoints
Force browser restart after update to ensure the patched binary is loaded
Verify enterprise update policies are not blocking or delaying the Stable channel rollout

Patch Information

Google released the fix in the Chrome Stable channel. See the Google Chrome Stable Update advisory for full release notes. Administrators managing Chrome through Group Policy or Chrome Browser Cloud Management should confirm that TargetVersionPrefix or update pinning does not hold endpoints on vulnerable builds.

Workarounds

Disable or restrict the ReadingList feature via enterprise policy where feasible until patching is complete
Enforce site isolation and strict process-per-site policies to increase the cost of chained renderer exploits
Restrict browsing to trusted sites through web filtering while the patch is deployed

bash

# Verify Chrome version on Windows endpoints via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Example Group Policy registry key to enforce minimum version compliance
reg query "HKLM\SOFTWARE\Policies\Google\Chrome\Update" /v TargetVersionPrefix