CVE-2026-79099

Published Aug 25, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Analysis

Technical impact

Missing authorization in the Network component of Google Chrome before 152.0.7977.65 allows a remote attacker to bypass system access restrictions via a crafted HTML page. The flaw permits unauthorized access to privileged browser operations without proper permission checks, potentially exposing sensitive data or enabling additional attacks.

Affected Systems

Google Chrome browsers on all platforms running versions earlier than 152.0.7977.65 are affected. Versions 152.0.7977.65 and later contain the fix.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.5, indicating medium severity. An attacker can host a malicious HTML page that, when viewed by a user, triggers unverified network requests that bypass system access controls. The EPSS score is <1% and the flaw is not listed in CISA KEV, indicating limited public exploitation data. Nonetheless, the ability to bypass system access could lead to privilege escalation or data exposure if the malicious content can reach the targeted machine.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`152.0.7977.65`	affected	< 152.0.7977.65

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Google

Chrome

Version	Status	Scheme	Platform
`[152.0.7977.65,152.0.7977.65)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Deploy Chrome version 152.0.7977.65 or newer to all systems that run Chrome.
Disable or remove any Chrome extensions that modify or bypass network access controls until the update is fully deployed.
Verify and update Chrome’s enterprise policy settings to enforce proper authorization controls and reflect the corrected behavior.

Generated by OpenCVE AI on August 29, 2026 at 00:02 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4771-1	chromium security update
Debian DSA	DSA-6482-1	chromium security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.286% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html
https://issues.chromium.org/issues/517608454

History

Sep 17, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 31, 2026 3:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:google:chrome::::::::

Aug 29, 2026 12:30 AM Title updated View changes

Type	Values Removed	Values Added
Title	Chrome Browsers Vulnerability: Missing Authorization Allows Bypass of System Access Restrictions

Aug 28, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}`

Aug 26, 2026 12:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Aug 25, 2026 11:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		Chrome Browsers Vulnerability: Missing Authorization Allows Bypass of System Access Restrictions

Aug 25, 2026 8:30 PM Description updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses		CWE-862
References		https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html https://issues.chromium.org/issues/517608454