Executive brief
Google Chrome's extension system failed to properly validate authorization when a renderer process was compromised, allowing an attacker to bypass web origin policy restrictions through a crafted HTML page. This could enable unauthorized access to sensitive web data and functionality that the extension normally protects. The vulnerability affects Chrome versions prior to 152.0.7977.65.
Technical details
CVE-2026-79190 is an incorrect authorization vulnerability in the Extensions component of Google Chrome. The vulnerability allows a remote attacker who has already compromised the renderer process to bypass web origin policy by crafting a malicious HTML page. The root cause is improper authorization checks in extension-related code when handling requests from a compromised renderer. An attacker would first need to achieve renderer process compromise (typically via another vulnerability), then exploit this flaw to escalate their access to protected web origins. Google patched this issue in Chrome 152.0.7977.65 and later. Chromium severity is rated as Low, though NVD severity assessment is Medium.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Chrome 152.0.7977.65 released