CVE-2026-79108 in Chrome
Summary
by MITRE • 08/26/2026
UI misrepresentation in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as UI misrepresentation in Web Authentication within Google Chrome versions prior to 152.0.7977.65 represents a significant trust boundary violation between the browser interface and the underlying authentication mechanisms, specifically affecting Passkeys and Security Keys implementations. This flaw stems from an inconsistency where the user interface fails to accurately reflect the true nature or context of the authentication request being processed by the operating system or hardware security module. In secure web authentication flows, particularly those utilizing the Web Authentication API, it is critical that users are presented with clear, unambiguous information regarding which application or origin is requesting credentials and what specific actions will be performed upon authorization. When this visual representation is manipulated or misleading, the integrity of the user's informed consent is compromised, creating a pathway for attackers to exploit human psychology rather than technical code flaws directly.
From a technical perspective, this vulnerability allows a remote attacker to craft an HTML page that deceives the browser into displaying authentication prompts in a manner that obscures the malicious intent behind the request. By leveraging social engineering techniques, such as mimicking legitimate login screens or presenting fake security warnings, the attacker can trick users into approving credential usage for unauthorized origins. The core issue lies not necessarily in the cryptographic strength of the Passkey itself but in the contextual framing provided to the user during the approval step. If the browser displays a trusted-looking interface while actually processing a request from a malicious domain, the user may inadvertently grant access to sensitive resources or perform actions they did not intend to authorize. This bypasses system access restrictions because the authentication mechanism correctly validates the credential against the attacker's origin due to the misleading context provided by the compromised UI layer.
The operational impact of this vulnerability is primarily centered around account takeover and unauthorized data access through social engineering rather than direct exploitation of software bugs in the cryptographic libraries. An adversary who successfully exploits this flaw can gain persistent or temporary access to user accounts protected by Passkeys, which are generally considered more secure than traditional passwords due to their resistance to phishing and credential stuffing attacks when implemented correctly. However, if the UI misleads the user into authenticating with a malicious site, the security benefits of hardware-backed keys are effectively neutralized for that specific session or interaction. This can lead to significant data breaches, financial loss in e-commerce scenarios, or further lateral movement within corporate networks if enterprise credentials are compromised. The severity is classified as low by Chromium because it requires active user participation and social engineering success, but the potential consequences remain severe given the high-value nature of accounts protected by modern authentication standards.
To mitigate this risk, users must upgrade to Google Chrome version 152.0.7977.65 or later, where these UI inconsistencies have been addressed through improved validation of origin contexts and clearer visual indicators for cross-origin requests. Security administrators should enforce strict content security policies that limit the domains allowed to invoke Web Authentication APIs, thereby reducing the attack surface available to potential attackers. Additionally, user education remains a critical component of defense-in-depth strategies; organizations must train employees to verify domain names carefully before approving authentication prompts and to recognize signs of UI spoofing or unexpected browser behavior. Monitoring for unusual authentication patterns, such as logins from unfamiliar locations immediately following visits to suspicious websites, can also help detect exploitation attempts in real-time.
This vulnerability aligns with CWE-20, Improper Input Validation, specifically regarding the validation of context and origin data presented to the user interface layer, although it is more accurately categorized under CWE-829, Inclusion of Functionality from Untrusted Control Sector, as the UI logic allows untrusted origins to influence security decisions. From an offensive perspective, this technique maps directly to MITRE ATT&CK tactic T1566, Phishing, specifically sub-technique T1566.002, Spearphishing Link, where the attacker uses a crafted link or page to deceive the user into interacting with malicious content that exploits trust in the browser interface. It also relates to T1078, Valid Accounts, as it facilitates unauthorized access by manipulating the authentication process itself rather than stealing credentials outright. Understanding these mappings helps security teams prioritize patching and monitoring efforts based on established threat intelligence frameworks.