CVE-2026-79099 in Chrome
Summary
by MITRE • 08/26/2026
Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as missing authorization within the network subsystem of Google Chrome, specifically affecting versions prior to 152.0.7977.65, represents a critical failure in enforcing access control policies during network operations. This flaw allows remote attackers to bypass system-level security restrictions by leveraging specially crafted HTML pages hosted on malicious websites. The core issue lies in the browser's handling of cross-origin requests and internal API calls where authentication tokens or permission checks were not adequately validated before executing sensitive network actions. By exploiting this gap, an attacker can trick the user into initiating connections that should otherwise be blocked due to insufficient privileges or policy violations, effectively circumventing the intended security boundaries established by the operating system or enterprise policies.
From a technical perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-913 Improvement of Control over Command Rate which often manifests in web applications when session management or permission validation is flawed during asynchronous network requests. The attack vector relies on social engineering combined with automated exploitation techniques where the crafted HTML page triggers specific browser behaviors that exploit the missing authorization check. This could involve manipulating fetch APIs, XMLHttpRequest objects, or WebSocket connections to perform actions such as accessing internal services, exfiltrating data from protected endpoints, or modifying system configurations without proper user consent or administrative approval. The severity is classified as medium because while it allows bypassing restrictions, it typically requires user interaction and does not provide full remote code execution capabilities directly but rather facilitates further exploitation steps like credential theft or lateral movement within a networked environment.
The operational impact of this vulnerability extends beyond simple data leakage; it undermines the integrity of browser-based security models that rely on strict origin policies and permission grants. In enterprise environments where Chrome is deployed with specific group policy configurations, such as blocking access to certain internal domains or restricting API usage, this flaw could allow malicious scripts to ignore those directives. This leads to potential unauthorized access to sensitive corporate resources, violation of compliance standards like GDPR or HIPAA if personal health information or personally identifiable data is accessed through these bypassed channels, and increased risk of phishing attacks succeeding by masking their true intent behind legitimate-looking network traffic patterns that evade detection systems expecting standard authorization flows.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.65 or later where the missing authorization checks have been corrected in the underlying Chromium engine codebase. Administrators should ensure automatic updates are enabled for all endpoints running affected versions to minimize exposure windows. Additionally, organizations can implement additional layers of defense such as Content Security Policy headers that restrict source domains and prevent unauthorized script execution even if browser-level controls fail. Network segmentation and strict firewall rules limiting outbound connections from workstations to untrusted external IPs provide a secondary safeguard against data exfiltration attempts facilitated by this vulnerability. Monitoring for anomalous network traffic patterns originating from the Chrome process can also help detect exploitation attempts in real-time, allowing security teams to respond before significant damage occurs.
This incident highlights the importance of rigorous code review processes focusing on access control logic within browser engines and underscores the need for continuous monitoring against ATT&CK techniques related to Command and Control via Application Layer Protocol or Defense Evasion through Obfuscated Files if attackers attempt to mask their activities using this flaw. Maintaining up-to-date software versions remains the most effective defense, supplemented by robust security awareness training for users who might be targeted with crafted HTML pages designed to exploit such browser vulnerabilities.