CVE-2026-79041 in Chrome
Summary
by MITRE • 08/26/2026
Missing authorization in Browser in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Low)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as missing authorization in Google Chrome on Mac prior to version 152.0.7977.65 represents a critical failure in the browser's enforcement of web origin policies, specifically within privileged contexts such as internal chrome:// pages or extension backgrounds that typically enjoy elevated privileges compared to standard web content. This flaw allows an attacker who has successfully leveraged social engineering techniques to trick a user into visiting a maliciously crafted HTML page to bypass these security boundaries. The core technical issue lies in the insufficient validation of authorization tokens or origin checks when handling requests from external origins, effectively permitting cross-origin access to resources that should remain isolated and protected under normal browsing conditions.
From a technical perspective, this vulnerability exploits the trust relationship between the browser engine and its internal components by circumventing the same-origin policy which is fundamental to web security. By crafting an HTML page with specific JavaScript payloads or iframe injections, an attacker can trigger actions within privileged pages that are not intended for public access. This bypass enables the reading of sensitive data stored in local storage, cookies, or session variables associated with authenticated sessions on internal sites, potentially leading to unauthorized access to user accounts or corporate resources if those services rely solely on browser-based authentication without additional server-side verification.
The operational impact of this vulnerability is significant for users who engage in high-risk browsing activities or handle sensitive information through their browsers. An attacker leveraging social engineering could gain persistent access to confidential data, perform actions on behalf of the victim such as changing settings or initiating transactions, and potentially escalate privileges within the application environment. Although classified with a low severity rating by Chromium security teams due to the requirement for user interaction via social engineering, the potential for data exfiltration and account takeover remains substantial in targeted attacks where users are coerced into visiting malicious sites through phishing emails or deceptive links.
To mitigate this risk, it is imperative that organizations enforce strict browser update policies ensuring all endpoints run version 152.0.7977.65 or later of Google Chrome on Mac systems. Security awareness training should be implemented to educate users about the dangers of visiting untrusted websites and recognizing social engineering tactics designed to bypass security controls. Additionally, deploying content security policy headers where applicable and utilizing browser extensions that restrict cross-origin requests can provide an additional layer of defense against such origin-based attacks. Monitoring for unusual activity in privileged contexts may also help detect exploitation attempts early before significant damage occurs.
This incident aligns with CWE-284 Improper Access Control which describes failures to enforce proper authorization checks, and relates to MITRE ATT&CK technique T1059 Command and Scripting Interpreter where attackers use scripting languages like JavaScript within web pages to execute malicious actions against the host system or connected services. Understanding these mappings helps security teams prioritize remediation efforts based on established industry standards for vulnerability management and threat intelligence integration.