CVE-2026-79289: Google Chrome Site Isolation Bypass Flaw

CVE-2026-79289 Overview

CVE-2026-79289 is a site isolation bypass in Google Chrome caused by improper control of a resource through its lifetime in the Workers component. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass site isolation through a crafted HTML page. Chromium rates the security severity as Low. The weakness is classified under CWE-664: Improper Control of a Resource Through its Lifetime.

Critical Impact
Successful exploitation lets an attacker with a compromised renderer break Chrome's site isolation boundary, undermining cross-origin protections that separate web content within the browser.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Workers implementation
Downstream builds that have not merged the Chromium fix

Discovery Timeline

2026-08-25 - CVE-2026-79289 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79289

Vulnerability Analysis

The issue resides in Chrome's Workers subsystem, which manages dedicated, shared, and service worker execution contexts. The Workers code path does not correctly control the lifetime of a resource associated with a worker. Because Workers cross process boundaries and interact with the site isolation model, a lifetime mismatch here can be leveraged to reach content that should belong to a different site principal.

Exploitation requires a two-stage attack chain. The attacker must first achieve execution inside a compromised renderer, typically through a separate memory corruption or logic bug. From that foothold, the crafted HTML page drives the Workers component into a state where the site isolation boundary can be bypassed. This bypass class is significant because site isolation is the primary defense that contains a compromised renderer to a single site's data.

Root Cause

The root cause is improper control of a resource through its lifetime [CWE-664] within the Workers implementation. Object ownership, teardown ordering, or reference tracking allows a resource tied to one security context to be observed or reused across the site isolation boundary. The Chromium fix in 152.0.7977.65 corrects the lifetime handling so that the resource cannot be accessed outside its intended scope.

Attack Vector

The attack vector is a crafted HTML page delivered to a browser where the renderer is already under attacker control. The vulnerability is not a standalone remote code execution primitive. It is a sandbox and isolation weakening bug that raises the impact of an existing renderer compromise. Public technical detail is limited to the Chromium Issue Tracker #497876969 and the Google Chrome Update Announcement.

// No public proof-of-concept is available. See the Chromium issue tracker
// entry referenced above for technical detail as it becomes public.

Detection Methods for CVE-2026-79289

Indicators of Compromise

Chrome or Chromium-based browser processes running versions earlier than 152.0.7977.65 in enterprise inventory.
Renderer process crashes or unexpected worker lifecycle events correlated with visits to untrusted pages.
Outbound requests from browser child processes to unexpected origins following interaction with attacker-controlled content.

Detection Strategies

Inventory installed browser versions across managed endpoints and flag any Chrome build below 152.0.7977.65.
Correlate browser exploitation attempts by joining web proxy telemetry with endpoint process events for the browser and its child renderers.
Alert on child processes spawned by the browser that deviate from a known-good baseline, since renderer compromise commonly precedes this bypass.

Monitoring Recommendations

Ingest browser version telemetry into your SIEM and build a rule that fires on vulnerable Chrome builds observed after the patch window closes.
Monitor for anomalous network egress from renderer processes to newly registered or low-reputation domains.
Track EPSS trend data for CVE-2026-79289 to detect a shift toward active exploitation likelihood over time.

How to Mitigate CVE-2026-79289

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on all desktop platforms.
Force browser relaunch across managed endpoints so that the patched binaries take effect.
Prioritize systems that browse untrusted or high-risk web content, since renderer compromise is a prerequisite for this bypass.

Patch Information

Google addressed CVE-2026-79289 in the Chrome Stable channel update shipping 152.0.7977.65. Details are published in the Google Chrome Update Announcement and tracked in Chromium Issue #497876969. Chromium-derived browsers should apply the corresponding upstream patch as soon as their vendors ship an updated build.

Workarounds

No vendor-supplied workaround replaces the update; apply 152.0.7977.65 or later as the primary remediation.
Restrict browsing to trusted sites through enterprise policy where full patching is delayed.
Enforce automatic Chrome updates via Group Policy or MDM so future Chromium security fixes deploy without manual action.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv