CVE-2026-79174 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization flaw within Google Chrome's extension system prior to version 152.0.7977.65 represents a critical breach in the browser's isolation mechanisms, specifically targeting the boundary between untrusted web content and privileged internal pages. This security severity is classified as High by Chromium because it allows for privilege escalation from a compromised renderer process, which should be sandboxed to prevent access to sensitive system resources or user data. The core technical flaw lies in how extensions interact with Chrome's internal APIs; when an extension loads a page that lacks proper authorization checks, the browser fails to enforce strict origin policies during navigation events involving privileged contexts such as chrome:// URLs or internal extension pages.
From a technical perspective, this vulnerability exploits the trust relationship between the renderer process and the browser process. In normal operation, Chrome isolates web content in separate processes with restricted permissions to mitigate the impact of code execution vulnerabilities like cross-site scripting (XSS) or remote code execution (RCE). However, if an attacker compromises a renderer through a malicious website containing crafted HTML, they can leverage this authorization bypass to navigate from their sandboxed context into privileged pages. This navigation does not trigger the necessary security checks that would normally validate whether the requesting origin has permission to access the target resource. Consequently, the extension system inadvertently grants elevated privileges to content that should remain restricted, effectively breaking the web origin policy which is fundamental to browser security architecture.
The operational impact of this vulnerability is severe for users who have installed extensions with broad permissions or those that dynamically load external resources without rigorous validation. An attacker can use a crafted HTML page hosted on any website to trigger the flaw when a user interacts with a vulnerable extension. Once inside a privileged page, the attacker gains access to sensitive data such as cookies, local storage, and potentially browser history or saved passwords depending on the specific privileges of the targeted internal page. This capability allows for session hijacking, credential theft, and further lateral movement within the victim's browsing environment. The ability to bypass origin policies means that traditional defenses like Same-Origin Policy (SOP) protections are rendered ineffective against attacks originating from compromised renderer processes interacting with these extension endpoints.
This flaw aligns closely with CWE-269 Improper Privilege Management, as it involves a failure to enforce required security permissions for an actor in the system. Additionally, it relates to CWE-749 Exposure of Sensitive Information to an Unauthorized Actor because the bypass allows unauthorized access to privileged interfaces that expose sensitive internal states or data. From an ATT&CK perspective, this vulnerability facilitates techniques associated with Defense Evasion and Credential Access, specifically allowing attackers to move laterally within a compromised environment by escalating privileges from low-level renderer processes to higher-privileged contexts. It also supports persistence mechanisms if the attacker can modify extension settings or inject malicious scripts into privileged pages that execute on subsequent loads.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.65 or later, where these authorization checks have been corrected to ensure strict adherence to origin policies during navigation events involving extensions. For organizations managing enterprise deployments, it is advisable to audit installed extensions for those that request excessive permissions or load external content dynamically without sufficient validation. Implementing Content Security Policy (CSP) headers on any custom extension pages can provide an additional layer of defense by restricting the sources from which scripts and other resources are loaded. Furthermore, users should be educated about the risks of installing unverified extensions and regularly reviewing their installed add-ons to remove those that are no longer needed or appear suspicious. Regular browser updates remain the most effective control against such vulnerabilities as they patch underlying architectural flaws before they can be widely exploited in the wild.