CVE-2026-79137 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization flaw within the Extensions subsystem of Google Chrome prior to version 152.0.7977.65 represents a significant breach in the browser's permission model, specifically targeting the isolation mechanisms that separate extension code from system resources and other web contexts. This security severity rating of Medium reflects the potential for unauthorized access while acknowledging that exploitation requires user interaction rather than being fully automatic or remote without engagement. The core technical flaw lies in how Chrome validates permissions when an extension attempts to interact with sensitive APIs or browser features, such as accessing local files, manipulating window properties, or communicating with native applications. In a properly secured environment, the browser should enforce strict checks ensuring that only explicitly granted and verified permissions allow access to these restricted areas. However, due to this authorization error, certain requests from maliciously crafted extensions were not correctly validated against the user's consent state or the extension's declared manifest capabilities, allowing code execution contexts with elevated privileges where they should have been confined.
The operational impact of this vulnerability is primarily driven by its reliance on social engineering tactics for exploitation. A remote attacker cannot simply push a payload to an unpatched system; instead, they must deceive a user into installing a malicious Chrome extension that appears legitimate or benign. Once installed, the crafted extension can leverage the authorization bypass to perform actions beyond what was disclosed in its permissions list during installation. This could include reading sensitive data from other tabs, accessing clipboard contents, injecting scripts into web pages with higher trust levels, or even interacting with operating system-level interfaces if native messaging hosts are involved. The ability to bypass these restrictions undermines the fundamental security boundary between untrusted web content and trusted browser functions, potentially leading to credential theft, session hijacking, or further lateral movement within a user's digital environment depending on the specific capabilities abused by the malicious extension.
From an industry standards perspective, this vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, specifically where software does not properly assign privileges for security-critical functions. It also relates to CWE-749, Exposed Dangerous Method or Function, as the flaw allows access to internal browser methods that should be restricted. In terms of threat modeling and adversary behavior, this scenario maps directly to MITRE ATT&CK technique T1566.002, Phishing: Spearphishing Attachment, if the extension is delivered via a deceptive link disguised as an update or tool, or more accurately to T1059.007, Command and Scripting Interpreter: JavaScript, combined with T1176, Browser Extensions, which details how attackers use legitimate software features for malicious purposes. The social engineering aspect emphasizes the importance of user awareness alongside technical controls, as the initial vector depends on convincing a victim to grant installation rights to untrusted code.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary and most effective mitigation is to update Google Chrome to version 152.0.7977.65 or later, where the authorization logic has been corrected to properly enforce permission boundaries for all extensions. Organizations should implement automated patch management systems to ensure timely deployment of browser updates across all endpoints. Additionally, users and administrators should adopt a principle of least privilege by regularly auditing installed Chrome extensions, removing any that are unused, unverified, or originate from unknown publishers. Enforcing strict extension installation policies through enterprise configuration templates can prevent the installation of unauthorized third-party extensions entirely. Furthermore, enabling Google Play Protect for Android devices running Chrome adds an additional layer of scanning against known malicious patterns, although this is less relevant for desktop environments where manual review and policy enforcement remain critical defenses against social engineering-driven extension installations.