CVE-2026-79116 in Chrome
Summary
by MITRE • 08/26/2026
Missing authorization in Viz in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as missing authorization within the Viz component of Google Chrome prior to version 152.0.7977.65 represents a significant breach in browser isolation mechanisms. The Viz compositor is responsible for handling graphics operations and managing the composition of web content, effectively acting as an intermediary between the renderer process and the GPU or display output. When this component lacks proper authorization checks, it fails to validate whether incoming requests from compromised renderer processes are legitimate or authorized by the browser's security policy. This architectural flaw undermines the fundamental principle of sandboxing that protects users from malicious code execution within web pages.
A remote attacker who has successfully achieved arbitrary code execution within a renderer process can exploit this deficiency to bypass web origin policies. By crafting specific HTML and JavaScript payloads, an adversary can send unauthorized commands to the Viz component. Since the vulnerability allows these requests to proceed without adequate verification of their source or intent, the attacker gains the ability to interact with resources that should be restricted by same-origin policy rules. This effectively neutralizes one of the primary defenses against cross-site scripting and data exfiltration attacks, allowing malicious scripts to access sensitive information from other domains or manipulate UI elements across different origins.
The operational impact of this vulnerability is severe in scenarios where a user visits a compromised website that executes exploit code targeting this specific flaw. Although the initial entry point requires compromising the renderer process, which typically involves exploiting another vulnerability such as a use-after-free or type confusion bug, the subsequent escalation via Viz authorization bypass significantly increases the attack surface. The attacker can potentially read cookies, local storage data, and DOM content from other tabs or windows that share the same browser instance but different origins. This capability facilitates sophisticated phishing campaigns, session hijacking, and unauthorized access to user accounts on sensitive platforms such as banking services or corporate intranets.
From a classification perspective, this issue aligns with CWE-269, which denotes Improper Authorization, specifically in contexts where privilege escalation occurs within a multi-process architecture. It also relates closely to ATT&CK technique T1053, Scheduled Task/Job, if the attacker leverages system-level privileges gained through renderer compromise, but more directly maps to browser-specific isolation bypasses often categorized under lateral movement or defense evasion tactics that exploit trust relationships between processes. The Chromium security team has classified this with a medium severity rating, reflecting its dependency on prior renderer compromise while acknowledging the high impact of successful origin policy bypass.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.65 or later, where these authorization checks have been reinforced within the Viz component. For organizations managing large deployments, implementing automated patch management systems ensures timely application of security updates across all endpoints. Additionally, deploying browser isolation solutions can provide an additional layer of protection by rendering web content in a secure cloud environment, thereby preventing local renderer compromises from affecting user data even if origin policies are bypassed locally. Users should also maintain strict browsing hygiene and utilize extensions that enforce enhanced privacy settings to reduce the likelihood of encountering malicious payloads capable of triggering such vulnerabilities.