CVE-2026-79085 in Chrome
Summary
by MITRE • 08/26/2026
Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as missing authorization within the network subsystem of Google Chrome prior to version 152.0.7977.65 represents a significant breach in browser isolation mechanisms, specifically targeting the boundary between renderer processes and privileged system resources. This flaw allows an attacker who has already achieved code execution or arbitrary script injection within a compromised renderer process to escalate their privileges by bypassing web origin policies. The core technical failure lies in the network service's insufficient validation of authorization tokens when handling requests initiated from untrusted contexts, effectively allowing malicious scripts to interact with internal APIs or resources that should remain inaccessible under standard sandboxing rules.
From a technical perspective, modern browsers like Chrome utilize a multi-process architecture where each tab and extension runs in an isolated renderer process to limit the blast radius of potential exploits. The origin policy is a critical security feature designed to prevent documents loaded from one origin from accessing sensitive data or performing actions on behalf of another origin without explicit permission. In this instance, the network layer failed to enforce these restrictions properly when processing crafted HTML pages. An attacker could construct a malicious webpage that leverages specific API calls or fetch requests which, due to the authorization gap, are processed by the browser's privileged components as if they originated from a trusted source. This bypasses the same-origin policy, enabling cross-site request forgery-like behaviors or unauthorized data exfiltration even when traditional sandboxing measures might otherwise block direct DOM access.
The operational impact of this vulnerability is severe for users who visit maliciously crafted websites while using an affected version of Chrome. If a user's browser is compromised through a drive-by download, phishing site, or ad network injection, the attacker can use this flaw to exfiltrate sensitive cookies, session tokens, or other authentication credentials stored by the browser. Furthermore, it allows for more sophisticated attacks such as taking over active sessions on banking or email services if those sites do not implement additional protections like CSRF tokens that are immune to origin bypasses via network-level flaws. The Chromium security team classified this issue with a medium severity rating, reflecting its potential for exploitation in targeted scenarios rather than widespread automated campaigns, yet it remains critical for maintaining the integrity of user identity and data privacy within the browser environment.
This vulnerability aligns closely with CWE-269, which describes Improper Authorization, as well as CWE-345 regarding Insufficient Verification of Data Authenticity when dealing with cross-origin requests. In terms of offensive security frameworks, this exploit technique maps to MITRE ATT&CK techniques related to Browser Security Misconfiguration and potentially T1078 Valid Accounts if the attacker leverages stolen credentials obtained through the origin bypass. The flaw highlights the complexity inherent in maintaining strict boundaries between untrusted web content and privileged browser services, emphasizing that even minor lapses in authorization checks within network handling can undermine the entire sandboxing model.
To mitigate this risk, users must immediately update Google Chrome to version 152.0.7977.65 or later, where these authorization checks have been hardened. For organizations deploying browsers at scale, enforcing automatic updates through group policy or endpoint management solutions is essential to ensure all endpoints are protected against such origin bypass vulnerabilities. Additionally, developers should review their web applications for reliance on implicit trust in browser-origin enforcement and implement robust server-side validation for sensitive actions. While client-side mitigations like Content Security Policy can help restrict certain types of script execution, they cannot fully compensate for underlying browser engine flaws, making patching the primary defense against this specific class of network-level authorization failures.