CVE-2026-79251: Google Chrome Auth Bypass Vulnerability

CVE-2026-79251 Overview

CVE-2026-79251 is an improper input validation vulnerability [CWE-20] in the Network component of Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to potentially bypass the web origin policy through a crafted HTML page. Chromium classifies the security severity as Medium.

The flaw undermines the Same-Origin Policy (SOP), a foundational browser security boundary. A successful bypass can expose cross-origin data to attacker-controlled pages. Exploitation requires the victim to load a malicious page in an unpatched Chrome browser.

Critical Impact
Attackers can bypass web origin policy through a crafted HTML page, potentially exposing cross-origin data handled by the browser network stack.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers that inherit the vulnerable Network component
Embedded applications using pre-patch Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79251 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79251

Vulnerability Analysis

The vulnerability resides in Chrome's Network component, which handles URL parsing, request scheduling, and cross-origin enforcement. Improper input validation on network-facing inputs allows a crafted HTML page to influence how the browser interprets origin boundaries. The result is a bypass of the web origin policy, weakening the isolation guarantees enforced by Chromium.

Web origin policy determines which resources a document may read or interact with across origins. When the network layer misinterprets or fails to validate origin-related inputs, an attacker-controlled page can access data that should remain inaccessible. This class of flaw commonly enables data disclosure across sites and can amplify follow-on attacks such as credential theft or session data extraction.

The vendor has not published exploitation details in the referenced advisories. Public references include the Google Chrome Stable Update announcement and the restricted Chromium Issue Tracker #513392351.

Root Cause

The root cause is improper input validation [CWE-20] within the Network component. The affected code path accepts inputs that should be rejected or normalized before origin checks execute. This validation gap enables conditions under which cross-origin restrictions no longer apply as intended.

Attack Vector

Exploitation is remote and requires user interaction. The attacker hosts or injects a crafted HTML page. When a victim using an unpatched Chrome build loads that page, the malicious content triggers the validation flaw and bypasses the origin boundary. No authentication is required on the attacker side, and delivery can occur via phishing links, malvertising, or compromised websites.

No public proof-of-concept, exploit code, or CISA KEV listing exists for this CVE at time of publication. The EPSS score is 0.237% (percentile 14.56) as of 2026-08-27.

Detection Methods for CVE-2026-79251

Indicators of Compromise

Chrome browser processes with versions below 152.0.7977.65 observed rendering untrusted external content
Unexpected cross-origin resource reads or fetch activity from user browsing sessions
Outbound connections from browser processes to newly registered or low-reputation domains hosting HTML payloads

Detection Strategies

Inventory installed Chrome and Chromium-based browser versions across managed endpoints and flag builds prior to 152.0.7977.65
Correlate browser process telemetry with DNS and HTTP logs to identify visits to suspicious HTML pages preceding anomalous cross-origin behavior
Monitor for browser child processes performing unusual data exfiltration patterns after loading external content

Monitoring Recommendations

Ingest endpoint browser telemetry into a centralized data lake for version tracking and behavioral analysis
Alert on Chrome installations that fall behind the current stable channel release
Review web proxy logs for hits to domains flagged in threat intelligence feeds and correlate with browser sessions

How to Mitigate CVE-2026-79251

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force restart of Chrome processes after update to ensure the patched binary is loaded into memory
Audit Chromium-based applications and embedded browser components for the vulnerable version and update accordingly

Patch Information

Google released the fix in the Chrome Stable Channel update referenced in the Chrome Releases blog. Administrators should deploy version 152.0.7977.65 or later through enterprise update channels or managed browser policies.

Workarounds

Restrict browsing to trusted sites through enterprise proxy or DNS filtering until patching is complete
Enforce Chrome auto-update policies via group policy or MDM to prevent version drift
Disable or restrict rendering of untrusted HTML content in embedded browser components where feasible

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enforce minimum version via Chrome Enterprise policy (JSON snippet)
# Place in Chrome managed policies
{
  "BrowserSignin": 1,
  "ComponentUpdatesEnabled": true,
  "DefaultBrowserSettingEnabled": true
}