CVE-2026-79259: Google Chrome Safebrowsing Auth Bypass

CVE-2026-79259 Overview

CVE-2026-79259 is an improper input validation vulnerability [CWE-20] in the Safe Browsing component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can bypass system access restrictions by delivering a crafted file to a targeted user. Chromium classifies the security severity as Medium.

The vulnerability weakens a defense-in-depth mechanism that normally warns users before executing potentially unsafe downloads. Attackers can leverage this bypass as part of a broader delivery chain for malware or unwanted software.

Critical Impact
Remote attackers can bypass Chrome Safe Browsing file-access restrictions using a crafted file, undermining protections against malicious downloads.

Affected Products

Google Chrome Desktop prior to 152.0.7977.65
Chromium-based browsers that inherit the affected Safe Browsing code path
Downstream distributions bundling vulnerable Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79259 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79259

Vulnerability Analysis

The defect resides in Chrome's Safe Browsing subsystem, which validates downloaded files against reputation and policy checks before granting them access to the host system. Improper validation of file inputs allows an attacker-supplied file to slip past enforcement logic and be treated as trusted.

Because the bypass targets Safe Browsing rather than the renderer sandbox, exploitation does not require memory corruption. The attacker instead abuses missing or incorrect checks against file attributes handled by the download and Safe Browsing pipelines.

Successful exploitation removes user-facing warnings or restrictions that would otherwise block execution of untrusted content. This shifts the burden of judgment entirely to the user and any secondary endpoint controls.

Root Cause

The root cause is improper input validation [CWE-20] in Safe Browsing logic that processes attacker-controlled file metadata or content. Chrome fails to reject or properly classify a crafted file, allowing it to be treated as safe for local access.

Attack Vector

An attacker hosts a crafted file on a controlled site or delivers it through a phishing lure. When a targeted user retrieves the file through a vulnerable Chrome build, Safe Browsing does not enforce the expected access restriction. Full technical detail is tracked in Chromium Issue Tracker #513222422.

No verified proof-of-concept code is publicly available. Refer to the Google Chrome Stable Update advisory for the vendor description.

Detection Methods for CVE-2026-79259

Indicators of Compromise

Chrome download events for files with anomalous MIME types or extensions that were not flagged by Safe Browsing.
Execution of files immediately after browser-based delivery from low-reputation domains.
Browser telemetry showing suppressed or missing Safe Browsing verdicts for downloaded content.

Detection Strategies

Inventory Chrome installations and identify hosts running versions below 152.0.7977.65.
Correlate browser download events with subsequent process creation to surface bypassed warnings.
Alert on execution of downloaded content originating from newly registered or uncategorized domains.

Monitoring Recommendations

Ingest Chrome enterprise reporting and endpoint download telemetry into a central analytics pipeline.
Monitor for outbound connections to known malware distribution infrastructure following download activity.
Track user-agent strings and Chrome version fields across web proxy logs to identify unpatched clients.

How to Mitigate CVE-2026-79259

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Force restart of Chrome processes to ensure the patched binary is loaded after update.
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the upstream fix.

Patch Information

Google addressed the vulnerability in the Stable Channel release documented in the Google Chrome Stable Update advisory. Enterprises using managed Chrome should deploy the update through group policy, MDM, or the Chrome Browser Cloud Management console.

Workarounds

Enforce Chrome auto-update via policy so users cannot defer the patched build.
Restrict downloads of executable and script file types at the web proxy or secure web gateway.
Apply application allow-listing on endpoints to block execution of files originating from browser download directories.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on Linux endpoints
google-chrome --version