CVE-2026-79264: Google Chrome Auth Bypass Vulnerability

CVE-2026-79264 Overview

CVE-2026-79264 is an incorrect reference resolution vulnerability in the Preload component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can bypass the web origin policy by serving a crafted HTML page to a victim. Chromium rates the security severity as Medium. The flaw is classified under CWE-706: Use of Incorrectly-Resolved Name or Reference and affects the browser's handling of preloaded resources across origins. Successful exploitation undermines the Same-Origin Policy, which is a foundational browser security boundary.

Critical Impact
A crafted web page can bypass Chrome's web origin policy, potentially exposing cross-origin content to attacker-controlled script.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Preload code path
Downstream distributions until they integrate the upstream fix

Discovery Timeline

2026-08-25 - CVE-2026-79264 published to the National Vulnerability Database
2026-08-26 - Entry last modified in NVD

Technical Details for CVE-2026-79264

Vulnerability Analysis

The vulnerability resides in Chrome's Preload subsystem, which fetches resources referenced by <link rel="preload"> and related speculative-loading mechanisms. Preload resolves the identity of a resource and its associated security context before the resource is consumed by the rendering pipeline. When reference resolution is incorrect, the browser can treat a resource as if it belongs to a different origin than it actually does. This confusion breaks the Same-Origin Policy enforced by Chrome's process and renderer boundaries.

An attacker who controls an HTML page can leverage the flaw to induce the browser to associate cross-origin content with the attacker's document context. That association can expose response data or side-effects that should be gated by CORS and origin checks.

Root Cause

The defect maps to CWE-706, Use of Incorrectly-Resolved Name or Reference. Preload resolves a resource reference using logic that does not correctly reflect the effective security origin. As a result, subsequent origin checks operate on an incorrect key. See the Chromium Issue Tracker #507483993 for restricted implementation details.

Attack Vector

Exploitation requires the victim to visit a crafted HTML page under attacker control. No authentication is required, and the interaction is limited to normal browsing. The attacker page issues preload directives that trigger the incorrect reference resolution path, then reads or acts on cross-origin data that should be inaccessible. No verified public proof-of-concept is available at the time of writing; see the Google Chrome Desktop Update advisory for vendor guidance.

Detection Methods for CVE-2026-79264

Indicators of Compromise

Chrome browser processes reporting versions earlier than 152.0.7977.65 in endpoint inventory telemetry.
Outbound requests from user endpoints to newly registered or low-reputation domains that host HTML pages using aggressive <link rel="preload"> directives.
Web proxy logs showing preload fetches to cross-origin endpoints followed by unexpected data flows back to the originating page.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65.
Correlate browser telemetry with proxy or DNS logs to identify visits to suspicious sites that abuse preload features.
Monitor for anomalies in cross-origin resource fetches immediately preceded by preload hints.

Monitoring Recommendations

Ingest browser version and update status into your SIEM or asset management platform for continuous coverage.
Alert on endpoints that skip or fail Chrome auto-updates for more than one release cycle.
Track threat intelligence feeds for indicators tied to origin-policy bypass exploitation attempts.

How to Mitigate CVE-2026-79264

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Force a browser restart after update to ensure the patched binary is loaded.
Audit Chromium-based browsers and applications embedding CEF or Electron for pending upstream updates.

Patch Information

Google addressed CVE-2026-79264 in the Chrome Stable channel release documented in the Google Chrome Desktop Update. Users on Chrome 152.0.7977.65 or later on Windows, macOS, and Linux receive the fix. Enterprises managing Chrome via policy should validate that update channels are unblocked and that the auto-update service is running.

Workarounds

Restrict browsing to trusted sites using enterprise URL allow-lists until patching completes.
Disable or restrict Chrome preload and prefetch features via enterprise policy where operationally feasible.
Deploy web content filtering to block access to unknown or newly registered domains that host untrusted HTML content.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version