CVE-2026-79178 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization flaw within the Web Authentication subsystem of Google Chrome, specifically affecting versions prior to 152.0.7977.65, represents a significant deviation from expected access control mechanisms in modern web browsers. This security issue centers on the implementation of Passkeys and Security Keys, which are designed to provide strong, phishing-resistant authentication by leveraging public-key cryptography. The core technical flaw lies in how the browser validates the origin context during the cryptographic signing process associated with these credentials. Under normal operation, a Web Authentication API call should strictly bind the generated signature or assertion to the specific web origin that initiated the request, ensuring that credentials issued for one domain cannot be reused by another malicious entity. However, due to this authorization error, the browser failed to enforce strict origin isolation during certain authentication flows involving security keys and passkeys.
From a technical perspective, this flaw allows a remote attacker to exploit the lack of proper origin validation through a crafted HTML page hosted on an untrusted domain. When a user interacts with such a malicious webpage that attempts to invoke Web Authentication APIs, the browser may incorrectly associate the resulting cryptographic assertion with the legitimate target site rather than the actual requesting origin. This misalignment effectively bypasses the Same-Origin Policy (SOP), which is a critical security concept in web development designed to prevent one website from accessing data or performing actions on behalf of another without explicit permission. By manipulating this authorization check, an attacker can trick the browser into using credentials intended for a high-value target service within the context of their own malicious environment, thereby achieving unauthorized access or privilege escalation relative to the user's session state at that specific domain.
The operational impact of this vulnerability is substantial, particularly given the increasing adoption of passwordless authentication methods like Passkeys across major identity providers and enterprise environments. If an attacker successfully exploits this flaw, they could potentially impersonate a legitimate user on their own malicious site using credentials meant for another service, or more critically, manipulate session tokens that rely on Web Authentication assertions for integrity verification. This undermines the fundamental trust model of federated identity systems where security keys are used to prove possession of a private key tied to a specific relying party origin. The ability to bypass these checks means that even users with strong multi-factor authentication setups could be subjected to account takeover attacks if they inadvertently interact with malicious content while authenticated to sensitive services, as the browser might erroneously validate cross-origin requests using credentials bound to different origins.
In terms of industry standard classification, this vulnerability aligns closely with CWE-284 Improper Access Control and CWE-913 Improvement of Centralized Management of Controls when considering the failure in enforcing policy constraints within the authentication module. Furthermore, from an adversary tactics perspective as defined by MITRE ATT&CK, this exploit technique relates to T1078 Valid Accounts, specifically involving the misuse or bypassing of legitimate credentials through application layer vulnerabilities rather than credential theft via phishing or brute force. It also touches upon aspects of T1562 Impair Defenses if the browser's security features are manipulated to ignore standard web isolation protocols. The severity is rated as Medium by Chromium because while it requires user interaction and a crafted page, its potential for widespread exploitation in enterprise environments with high-value passkey deployments warrants immediate attention.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.65 or later, where the authorization logic has been corrected to strictly enforce origin binding during Web Authentication operations. Administrators should ensure that endpoint protection solutions are configured to detect and block attempts to exploit browser vulnerabilities through automated scripts or malicious web content delivery networks. Additionally, users can mitigate risk by disabling unnecessary extensions that might interfere with security key handling and by maintaining strict awareness of phishing indicators, although the technical fix in the browser binary is the definitive resolution for this specific authorization flaw. Continuous monitoring of browser update channels and integrating vulnerability management scans into enterprise deployment pipelines are recommended to prevent exposure to such origin-bypassing vulnerabilities in future releases.