CVE-2026-79260 Overview
CVE-2026-79260 is an improper input validation vulnerability [CWE-20] in the Cookies component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass the web origin policy by serving a crafted HTML page. Google's Chromium security team rated the underlying issue as Low severity, while NVD scored it Medium.
Critical Impact
An attacker with control of the renderer process can read cookie data across web origins, undermining the same-origin boundary that isolates authenticated sessions between sites.
Affected Products
- Google Chrome for Desktop prior to 152.0.7977.65
- Chromium-based browsers sharing the same Cookies implementation
- Any downstream distributions bundling the vulnerable Chromium build
Discovery Timeline
- 2026-08-25 - CVE-2026-79260 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79260
Vulnerability Analysis
The vulnerability resides in Chrome's Cookies handling logic. Chrome enforces the web origin policy to ensure that cookies scoped to one origin cannot be accessed by pages served from a different origin. This isolation is a foundational browser security control.
Exploitation requires an attacker to already control the renderer process. Renderer compromise is typically achieved through a separate memory corruption or type confusion primitive. Chained with this flaw, the compromised renderer can request or associate cookies in a way that violates origin isolation. The result is that cookies belonging to other origins become reachable from the attacker-controlled context.
Because the attacker starts from an already-compromised renderer, the flaw functions as a sandbox-adjacent origin bypass rather than an initial-access primitive. It expands the impact of any prior renderer exploit.
Root Cause
The root cause is improper validation of input associated with cookie operations in the Cookies subsystem. Chrome fails to fully verify the origin context when processing a crafted cookie state, allowing the browser to treat data from one origin as belonging to another. See Chromium Issue #533511967 for the tracked defect.
Attack Vector
Delivery is network-based and requires user interaction, such as visiting a crafted page. The attacker first compromises the renderer through an unrelated bug, then loads or interacts with attacker-controlled HTML that exercises the flawed cookie path. Successful exploitation discloses cookie contents across web origins without modifying integrity or availability of the target.
No verified proof-of-concept code is publicly available. Refer to the Google Chrome Stable Update announcement for vendor details.
Detection Methods for CVE-2026-79260
Indicators of Compromise
- Chrome processes running versions prior to 152.0.7977.65 on managed endpoints.
- Renderer process crashes or unexpected child-process spawns preceding suspicious outbound traffic.
- Unusual cross-origin cookie exfiltration patterns in web proxy or DNS logs following browsing sessions.
Detection Strategies
- Inventory installed browser versions and flag hosts running Chrome builds below 152.0.7977.65.
- Correlate renderer crash telemetry with subsequent outbound HTTP POST traffic containing session or authentication tokens.
- Monitor for exploit-chain precursors, such as Chrome sandbox escape signatures or memory corruption indicators, that could enable the required renderer compromise.
Monitoring Recommendations
- Ingest browser version telemetry into a central data lake for continuous version-drift monitoring.
- Alert on anomalous cookie-bearing requests to domains that do not match the referring origin.
- Track EPSS movement for CVE-2026-79260; the current EPSS probability of 0.232% indicates low predicted exploitation activity but should be revisited weekly.
How to Mitigate CVE-2026-79260
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
- Restart browser sessions after patch deployment to ensure the fixed binary is loaded.
- Audit third-party Chromium-based browsers and update to builds incorporating the corresponding Chromium fix.
Patch Information
Google addressed CVE-2026-79260 in Chrome Stable channel version 152.0.7977.65. Deploy the update through enterprise management tooling such as Google Chrome Enterprise, Microsoft Intune, or an equivalent software distribution system. Full release notes are available in the Google Chrome Stable Update announcement.
Workarounds
- Enforce Chrome auto-update policies through group policy or MDM to prevent version drift.
- Restrict browsing to trusted sites via URL allow-lists until patching completes on all endpoints.
- Use site isolation and strict SameSite cookie attributes on web applications to reduce cross-origin cookie exposure.
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString
# Verify installed Chrome version on Linux endpoints
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
