CVE-2026-79267: Google Chrome Workers Race Condition Flaw

CVE-2026-79267 Overview

CVE-2026-79267 is a race condition in the Workers component of Google Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass web origin policy by serving a crafted HTML page. Chromium assigned the issue a Medium security severity. The flaw is tracked under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition.

Critical Impact
Successful exploitation lets an attacker who controls a renderer bypass same-origin protections, enabling cross-origin data access from a compromised browser tab.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Workers implementation
Downstream distributions embedding pre-patch Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79267 published to the National Vulnerability Database
2026-08-26 - Entry last modified in NVD

Technical Details for CVE-2026-79267

Vulnerability Analysis

The vulnerability resides in Chrome's Workers subsystem, which manages background execution contexts such as dedicated, shared, and service workers. A race condition between concurrent operations creates a window where security state checks and subsequent use of that state are not atomic. An attacker who already controls the renderer process can exploit this timing gap to interact with worker contexts under an origin different from the one enforced by the browser's site isolation and same-origin policy.

Because the flaw requires prior renderer compromise, it functions as a chained primitive. Adversaries typically pair such bugs with an initial memory corruption or type confusion issue in the JavaScript engine or DOM to reach the renderer, then leverage this race to escalate the impact by reaching data belonging to other web origins.

Root Cause

The root cause is a Time-of-check Time-of-use (TOCTOU) condition [CWE-367] in the Workers implementation. Security-relevant properties such as the associated origin or execution context are validated at one point, but the validated state can change before it is used. Concurrent tasks on different threads observe inconsistent security state, allowing the check to succeed while the subsequent operation runs under attacker-influenced conditions.

Attack Vector

Exploitation requires the attacker to first compromise the renderer process, then serve a crafted HTML page that triggers the race condition in Workers. The crafted content orchestrates timing between worker creation, origin association, and cross-origin resource access to win the race. Full technical detail is restricted while the Chromium Issue Tracker entry 497839983 remains view-restricted, per Chromium's disclosure policy.

No public exploit code, proof-of-concept, or CISA Known Exploited Vulnerabilities listing is associated with this CVE at the time of publication.

Detection Methods for CVE-2026-79267

Indicators of Compromise

Chrome or Chromium-based browser processes running versions earlier than 152.0.7977.65 in the environment.
Renderer process crashes or unexpected worker creation patterns preceding cross-origin data access anomalies.
Outbound requests from browser processes to domains not associated with the user's active browsing origin.

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions across managed endpoints and flag builds below 152.0.7977.65.
Monitor for exploitation chains that typically precede renderer compromise, such as suspicious JavaScript engine crashes or sandbox anomalies.
Correlate browser telemetry with network egress to identify unexpected cross-origin data transfers originating from a single tab.

Monitoring Recommendations

Enable enterprise browser reporting through Chrome Browser Cloud Management to surface crash and extension telemetry.
Track update compliance for browser fleets and alert when endpoints remain on outdated Chrome channels beyond the patch release window.
Review web proxy logs for atypical origin transitions or requests that do not match the referring page context.

How to Mitigate CVE-2026-79267

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Push the update through managed browser tooling and verify installed versions after deployment.
Restart browser sessions to ensure the vulnerable Workers code is unloaded from memory.

Patch Information

Google released the fix in the Chrome Stable channel. Refer to the Google Chrome Stable Update advisory for release notes. Vendors of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi typically ship equivalent patches within days of the upstream release; consult each vendor's advisory for exact fixed versions.

Workarounds

No official workaround exists; upgrading to the patched Chrome build is the supported remediation.
Restrict use of untrusted or unnecessary browser extensions to reduce the attack surface that can lead to renderer compromise.
Enforce site isolation and strict extension policies through enterprise browser management until all endpoints are patched.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: read version from the application bundle
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString