CVE-2026-79110 in Chrome
Summary
by MITRE • 08/26/2026
Missing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as missing authorization in the preload mechanism of Google Chrome, specifically affecting versions prior to 152.0.7977.65, represents a significant deviation from expected web origin policy enforcement. This flaw resides within the browser's resource loading subsystem, which is responsible for pre-fetching and pre-rendering resources such as scripts, stylesheets, or images before they are explicitly requested by user interaction. The core technical issue stems from an insufficient access control check during this preload phase, allowing a remote attacker to manipulate the context in which these resources are loaded. By crafting a malicious HTML page that triggers specific preload behaviors, an adversary can force the browser to load sensitive data or execute scripts within a security boundary that should have been restricted by the same-origin policy. This bypass effectively undermines the isolation mechanisms designed to prevent cross-site scripting and unauthorized data access, creating a pathway for information disclosure or further exploitation of client-side applications.
From a technical perspective, this vulnerability aligns with CWE-284, Improper Access Control, as it involves an application failing to properly restrict actions based on user identity or privilege levels during the resource initialization process. The attack vector is classified under ATT&CK technique T1059, Command and Scripting Interpreter, specifically when leveraged for initial access or execution within a browser environment via crafted web content. Furthermore, because it involves bypassing origin policies to interact with resources across different domains without proper authorization, it also relates to CWE-346, Origin Validation Error. The severity is rated as medium by the Chromium security team, indicating that while exploitation requires specific conditions such as user interaction or a specially constructed webpage, the potential impact on confidentiality and integrity of web applications is substantial. Attackers can leverage this flaw to read sensitive data from other origins if those resources are inadvertently preloaded with elevated privileges or without adequate cross-origin resource sharing checks during the preload stage.
The operational impact of this vulnerability extends beyond simple data leakage; it compromises the fundamental trust model of modern web browsers. When origin policies are bypassed, attackers can potentially access cookies, local storage, or DOM elements belonging to other sites if those resources were preloaded in a context that did not enforce strict separation. This could lead to session hijacking, credential theft, or defacement depending on how the vulnerable preload mechanism interacts with specific web applications. For enterprise environments relying on Chrome for secure browsing, this flaw introduces risk into any workflow where users might visit untrusted sites while having active sessions with sensitive internal resources that utilize similar loading patterns. The ability to bypass these controls remotely means that no physical access or local privilege escalation is required, making it a viable threat vector in phishing campaigns or drive-by download scenarios where the victim visits a maliciously crafted page designed to exploit this specific browser behavior.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.65 or later, which includes patches for these access control checks within the preload subsystem. Administrators should ensure that automatic updates are enabled to maintain protection against such vulnerabilities as they are discovered and patched by upstream developers. In environments where immediate patching is not feasible due to compatibility concerns, network-level controls can provide a layer of defense. Implementing strict Content Security Policy headers on web applications served through the browser can help mitigate some downstream effects by restricting which sources are allowed to load resources or execute scripts. Additionally, monitoring for unusual patterns in resource loading that deviate from standard user-initiated requests may aid in detecting exploitation attempts in real-time. Regular security audits of web application configurations and adherence to secure coding practices regarding cross-origin resource sharing will further reduce the attack surface associated with such browser-level flaws.