CVE-2026-79261: Google Chrome Auth Bypass Vulnerability

CVE-2026-79261 Overview

CVE-2026-79261 is an incorrect authorization vulnerability [CWE-863] in the Controls component of Google Chrome. Versions prior to 152.0.7977.65 are affected. A remote attacker can bypass the web origin policy by serving a crafted HTML page to a victim. Chromium classifies the security severity as Low.

The flaw undermines the same-origin boundary that isolates content across web origins. Successful exploitation lets attacker-controlled pages influence resources or actions that should be restricted to another origin.

Critical Impact
A crafted HTML page can bypass Chrome's web origin policy, weakening the isolation between untrusted sites and content from other origins.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the affected Controls code
Downstream distributions embedding vulnerable Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79261 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79261

Vulnerability Analysis

The vulnerability resides in the Controls component of Google Chrome. Controls handles user interface elements that mediate access to media, form data, and other origin-scoped resources. An incorrect authorization check permits actions across origins that should be blocked by the web origin policy.

An attacker hosting a malicious page can influence behavior tied to another origin loaded in the same browser session. The bypass affects the browser-enforced boundary, not server-side controls.

The issue is tracked as Chromium Issue #514408247. Chromium engineers addressed it in the Stable channel release documented in the Google Chrome Stable Update.

Root Cause

The defect is an authorization logic error classified under [CWE-863] Incorrect Authorization. The Controls code path fails to correctly evaluate the requesting origin before permitting an action. As a result, cross-origin requests pass a check that should reject them.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. No privileged access is needed on the target system. The attacker delivers the page through a link, advertisement, compromised site, or embedded frame. Once the page executes, it invokes the Controls logic to reach data or actions tied to a different origin.

No verified public proof-of-concept is available. The Chromium security team rated the underlying severity as Low, and no exploitation in the wild has been reported.

Detection Methods for CVE-2026-79261

Indicators of Compromise

Chrome browser instances reporting a version earlier than 152.0.7977.65 in enterprise inventory data.
Web proxy logs showing user navigation to unfamiliar domains that serve HTML with cross-origin resource requests to sensitive sites.
Endpoint telemetry indicating Chrome processes making requests to origins the user did not intentionally visit.

Detection Strategies

Query endpoint inventory for Chrome versions and flag hosts below 152.0.7977.65.
Correlate browser process telemetry with outbound HTTP requests to identify anomalous cross-origin patterns following visits to unknown domains.
Monitor Chrome update channels and confirm that managed policies enforce automatic updates.

Monitoring Recommendations

Ingest browser version data into the SIEM to sustain continuous version compliance reporting.
Track Chrome crash and error telemetry for anomalies that may indicate exploitation attempts against the Controls component.
Alert on execution of Chrome instances that have disabled automatic updates or are running with --disable-web-security style flags.

How to Mitigate CVE-2026-79261

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on all managed endpoints.
Restart Chrome after the update to ensure the patched binaries are loaded into memory.
Verify that Chrome auto-update is enabled and not blocked by group policy or network filtering.
Audit Chromium-based browsers and embedded frameworks for the same underlying code.

Patch Information

Google released the fix in the Chrome Stable channel. Reference the Google Chrome Stable Update advisory for release notes and the Chromium Issue #514408247 tracker for the upstream fix record. Administrators should validate the running version by navigating to chrome://settings/help.

Workarounds

No vendor-supplied workaround exists; apply the patch as the primary remediation.
Restrict user browsing to trusted sites through web proxy allowlists until updates propagate.
Enforce enterprise policy DefaultBrowserSettingEnabled and update controls to guarantee timely patch delivery.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enforce auto-update via Chrome enterprise policy (Linux example)
cat > /etc/opt/chrome/policies/managed/auto_update.json <<EOF
{
  "AutoUpdateCheckPeriodMinutes": 60,
  "UpdateDefault": 1
}
EOF