CVE-2026-79190 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization flaw within Google Chrome's extension system prior to version 152.0.7977.65 represents a significant breach in the browser's multi-process architecture, specifically targeting the isolation mechanisms that separate untrusted web content from privileged extension code. This security severity is classified as low by Chromium standards because it requires an attacker who has already achieved compromise of the renderer process to exploit it. The core technical flaw lies in the insufficient validation of permissions when extensions interact with or are invoked through maliciously crafted HTML pages, allowing for a bypass of web origin policies that are designed to restrict cross-origin data access and script execution.
From a technical perspective, modern browsers rely on strict sandboxing where each tab runs in its own renderer process with limited privileges. However, browser extensions operate with elevated permissions granted by the user at installation time. The vulnerability arises when an extension fails to properly verify that the calling context is legitimate or authorized before executing privileged operations. An attacker who has exploited a separate vulnerability within a webpage's JavaScript environment can inject crafted HTML content that interacts with specific extension APIs. Due to the authorization gap, these interactions are not correctly filtered based on origin constraints, effectively allowing the compromised renderer process to leverage the extension's higher privileges to perform actions it should be restricted from doing under normal web security models.
The operational impact of this vulnerability centers on the potential for cross-origin data theft and unauthorized state manipulation within the context of installed extensions. By bypassing web origin policies, an attacker could potentially access sensitive user data stored by extensions, such as authentication tokens, personal information, or browsing history, which are typically protected from standard webpage scripts. This undermines the principle of least privilege that browsers enforce to protect users from malicious websites. While the requirement for prior renderer compromise limits the attack surface compared to zero-click exploits, it remains a critical risk in scenarios where drive-by downloads or phishing attacks successfully execute arbitrary code within a browser tab containing vulnerable extensions.
This flaw aligns with CWE-269, which describes Improper Control of Contextual State and Function, as well as CWE-862, the Missing Authorization check. In terms of offensive security frameworks like MITRE ATT&CK, this behavior relates to techniques involving privilege escalation within a process or container environment, specifically leveraging existing access to gain higher-level permissions without detection. The exploitation path typically involves lateral movement from a compromised web page into the extension runtime space, violating the expected boundaries between untrusted and trusted code execution environments.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.65 or later, where these authorization checks have been hardened to ensure that extensions correctly validate the origin of incoming requests before executing privileged functions. Administrators should enforce automatic updates for all users to minimize exposure windows. Additionally, security best practices recommend auditing installed browser extensions and removing any that are no longer necessary or originate from untrusted publishers, as reducing the attack surface by limiting extension permissions can mitigate the potential impact even if similar vulnerabilities exist in other components. Users should also remain vigilant against suspicious scripts injected into web pages, employing content security policies where applicable to restrict inline script execution and reduce the likelihood of renderer compromise occurring in the first place.