CVE-2026-79255: Google Chrome WebRTC Auth Bypass Vulnerability

CVE-2026-79255 Overview

CVE-2026-79255 is an improper input validation vulnerability [CWE-20] in the WebRTC component of Google Chrome. The flaw affects versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass the web origin policy by serving a crafted HTML page. Google classified the Chromium security severity as Medium. The issue reaches beyond same-origin protections that isolate web content in the browser. Exploitation requires prior compromise of the renderer, so the vulnerability is typically chained with a separate renderer bug.

Critical Impact
An attacker with a compromised renderer can bypass same-origin restrictions through WebRTC, enabling cross-origin data access from a crafted HTML page.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers embedding the affected WebRTC code
Desktop Stable channel builds tracked in the Chrome Releases advisory

Discovery Timeline

2026-08-25 - CVE-2026-79255 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79255

Vulnerability Analysis

The vulnerability resides in WebRTC, the real-time communication stack embedded in Chrome. WebRTC handles peer-to-peer media, data channels, and negotiation between browser contexts. Improper input validation in this component allows a renderer process operating outside its assigned origin to interact with resources tied to a different origin. The same-origin policy is a foundational browser security boundary that isolates documents, scripts, and network responses across origins. Bypassing this boundary exposes cross-origin data such as cookies, session tokens, or DOM content that the renderer would otherwise be prevented from reading.

Root Cause

The root cause is missing or incomplete validation of input processed by WebRTC before it is used to make origin-related decisions. Because the renderer is treated as an untrusted principal in Chrome's site isolation model, WebRTC must independently enforce origin checks on data crossing the boundary. The affected code path did not adequately validate that input, allowing crafted HTML and associated WebRTC calls to influence origin resolution. Google fixed the defect in Chrome 152.0.7977.65, tracked as Chromium issue 511794959.

Attack Vector

Exploitation requires two conditions. First, the attacker must have already compromised the renderer process, typically through a separate memory safety or logic bug. Second, the attacker delivers a crafted HTML page that triggers the vulnerable WebRTC code path. The crafted page manipulates WebRTC state so that origin checks return an incorrect result. The renderer then acts on data or issues requests as if they belonged to a different origin, bypassing web origin policy enforcement. See the Chromium Issue #511794959 tracker and the Google Chrome Stable Update for the technical fix reference.

Detection Methods for CVE-2026-79255

Indicators of Compromise

Chrome browser processes running versions prior to 152.0.7977.65 in enterprise inventories
Unexpected WebRTC session establishment from browser tabs that should not initiate peer connections
Renderer process crashes or anomalous child process behavior preceding cross-origin data access
Outbound STUN, TURN, or ICE traffic from endpoints where WebRTC use is not expected

Detection Strategies

Inventory browser versions through endpoint management tooling and flag hosts below the patched build
Correlate renderer crash telemetry with subsequent network activity to surface possible chained exploitation
Monitor for suspicious HTML delivery patterns, including drive-by pages hosting WebRTC negotiation code from low-reputation domains

Monitoring Recommendations

Ingest Chrome update and version telemetry into centralized logging for continuous version compliance checks
Track WebRTC-related network flows (UDP to STUN/TURN servers) from user endpoints and baseline expected behavior
Alert on browser processes spawning unexpected child processes or writing to sensitive paths after visiting untrusted sites

How to Mitigate CVE-2026-79255

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force browser restart through enterprise policy to ensure the patched binary is loaded
Audit Chromium-based browsers and Electron applications embedding older WebRTC code and update accordingly
Restrict access to untrusted sites via web proxy or DNS filtering while patch rollout completes

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. The fix is included in Chrome 152.0.7977.65. The corresponding Chromium bug is tracked as Chromium Issue #511794959. Deploy the update through standard enterprise browser management channels.

Workarounds

No vendor-supplied workaround exists; upgrading to the patched Chrome build is the required remediation
Where patching is delayed, disable WebRTC through enterprise policy on high-risk user groups to reduce exposure
Enforce site isolation and strict origin policies through Chrome enterprise policies to reduce renderer-level attack surface

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify Chrome version on Linux
google-chrome --version

# Force update via enterprise policy (Windows GPO registry key)
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f