CVE-2026-79262: Google Chrome Authorization Bypass Vulnerability

CVE-2026-79262 Overview

CVE-2026-79262 is an incorrect authorization vulnerability [CWE-863] in the Network component of Google Chrome. Versions prior to 152.0.7977.65 fail to enforce the web origin policy correctly. A remote attacker can bypass origin restrictions by serving a crafted HTML page to a targeted user. Chromium classifies the security severity as Medium.

The flaw undermines a core browser security boundary that isolates content across origins. Successful exploitation requires no privileges beyond luring a user to attacker-controlled content. Google addressed the issue in the Chrome Stable channel update for desktop.

Critical Impact
Attackers can bypass same-origin restrictions from a crafted web page, potentially exposing cross-origin data or enabling unauthorized network requests against protected resources.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers that inherit the vulnerable Network stack
Downstream distributions pending upstream merge of the Chromium fix

Discovery Timeline

2026-08-25 - CVE-2026-79262 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79262

Vulnerability Analysis

The vulnerability resides in the Network component of Chrome, which mediates HTTP requests, responses, and cross-origin policy checks. An authorization decision within this component does not correctly validate the requesting origin against the target resource. As a result, a crafted HTML page can trigger network operations that should be blocked by the browser's web origin policy.

Web origin policy, commonly implemented as the Same-Origin Policy (SOP) alongside Cross-Origin Resource Sharing (CORS), prevents documents from one origin from reading or acting on resources from another. When the check is skipped or incorrectly evaluated, attacker-controlled JavaScript can access data or perform actions that violate this boundary.

Root Cause

The root cause is an incorrect authorization check [CWE-863] within Chrome's Network implementation. The affected logic evaluates a request but fails to apply the correct origin comparison or policy decision before permitting it. Google's public advisory does not disclose the specific code path, and the Chromium issue tracker entry (497338168) remains restricted at the time of publication.

Attack Vector

Exploitation begins with a user visiting a crafted HTML page controlled by the attacker. The page issues network operations that leverage the incorrect authorization to reach cross-origin endpoints or read cross-origin data. No authentication or elevated privileges are required on the target system. The attack proceeds entirely within the browser context.

No verified public proof-of-concept code is available. See the Google Chrome Stable Update announcement and the Chromium Issue Tracker entry for vendor-provided details.

Detection Methods for CVE-2026-79262

Indicators of Compromise

Browser telemetry showing Chrome versions earlier than 152.0.7977.65 in active use across managed endpoints.
Outbound requests from browser processes to unexpected cross-origin endpoints immediately following visits to untrusted sites.
Web server logs recording cross-origin requests that lack the expected Origin or Referer headers consistent with policy-enforced traffic.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65.
Correlate proxy and DNS logs with browsing activity to identify anomalous cross-origin fetches from user endpoints.
Monitor for phishing lures and suspicious HTML attachments that could serve as delivery vehicles for exploitation.

Monitoring Recommendations

Enable and review browser update compliance reporting through enterprise management tools such as Chrome Browser Cloud Management.
Track EPSS updates for CVE-2026-79262 to detect changes in exploitation likelihood; the score at publication is approximately 0.29% (percentile 20.8).
Alert on endpoints that repeatedly defer Chrome updates beyond patch policy thresholds.

How to Mitigate CVE-2026-79262

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Restart Chrome after the update to ensure the patched Network component is loaded.
Verify that Chromium-based browsers in your environment have merged the corresponding upstream fix.

Patch Information

Google released the fix in the Chrome Stable channel update covered by the Google Chrome Stable Update announcement. The tracked defect is referenced in the Chromium Issue Tracker. Administrators should confirm the deployed build reports 152.0.7977.65 or higher via chrome://version.

Workarounds

Restrict browsing to trusted sites through enterprise URL allow-listing until patching completes.
Deploy content filtering at the proxy layer to block newly registered or low-reputation domains that could host crafted pages.
Enforce strict Content Security Policy (CSP) and CORS headers on internally hosted applications to limit the value of any cross-origin bypass.

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force update policy via Group Policy registry (Windows)
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f

# macOS: check installed Chrome version
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version