Executive brief
Google Chrome's Web Authentication feature (used for passkeys and security keys) contains an authorization flaw that allows attackers to bypass the web origin policy—the security mechanism that prevents malicious websites from using your passkeys or security keys. An attacker hosting a crafted webpage could potentially trick the browser into accepting authentication credentials meant for a legitimate site, compromising the security of accounts protected by passkeys or security keys.
Technical details
The vulnerability is an incorrect authorization flaw in Chrome's Web Authentication implementation (Passkeys & Security Keys), tracked as CVE-2026-79178. A remote attacker can craft a malicious HTML page that bypasses the web origin policy—the mechanism that binds authentication credentials to specific domain origins. The attack is network-based and requires the user to visit a crafted page; no authentication or special privileges are needed. By exploiting this, an attacker could bypass origin restrictions and potentially perform unauthorized authentication operations. The vulnerability was patched in Chrome 152.0.7977.65.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65