CVE-2026-79093

Executive Summary

CVE-2026-79093 is a High-severity incorrect authorization vulnerability in the Paint component of Google Chrome, fixed in version 152.0.7977.65. A remote attacker can exploit this flaw by luring a victim to a crafted HTML page, potentially bypassing web origin policy checks and accessing resources outside the intended security context. While no public exploit, PoC, or CISA KEV listing exists at the time of writing, the drive-by nature and High severity rating warrant immediate patching attention for enterprise environments relying on Chrome as their primary browser.

Technical Analysis

Vulnerability Class: Incorrect Authorization (CWE-863)

The vulnerability resides in the Paint component of Chrome, which is part of the browser's rendering pipeline responsible for rasterization and compositing of web content. The CWE-863 classification indicates that the software fails to perform proper authorization checks when a user attempts to access a resource or execute a function. In this context, the missing or incorrect authorization allows a web page to bypass Chromium's origin policy enforcement.

Attack Mechanism

The NVD description states that the flaw allows "a remote attacker to potentially bypass web origin policy via a crafted HTML page." Web origin policy (same-origin policy) is a fundamental security boundary in browsers that restricts how documents or scripts loaded from one origin can interact with resources from another origin. A bypass of this mechanism means:

1. Cross-origin data access: A malicious page could read data from other origins the user has open in other tabs or windows.
2. SOP enforcement failure: The Paint component's incorrect authorization checks fail to validate that the source origin has permission to access the target resource.
3. User interaction required: The trigger requires the victim to visit a "crafted HTML page," indicating a drive-by scenario or social engineering lure.

Technical Specifics

The NVD description does not provide function names, specific API endpoints, or detailed code paths. The vulnerability class (incorrect authorization) combined with the affected component (Paint) suggests the flaw lies in how the paint/rasterization pipeline validates the origin of content being rendered. Insufficient technical detail is available regarding the exact code path or the specific authorization check that is bypassed.

Attack Surface

• Affected product: Google Chrome (all platforms — Windows, macOS, Linux, Android, and ChromeOS)
• Prerequisite: Victim must visit a malicious webpage served by the attacker
• Complexity: No special conditions beyond the crafted page required; success depends on the specific rendering scenarios triggered by the page's content
• Interactions: Requires user to access the malicious URL (no pre-existing session or authentication needed)

Exploitation Scenarios

Step 1 — Reconnaissance / Target Identification

The attacker hosts a malicious HTML page on an attacker-controlled domain. Delivery vectors include:

• Phishing emails containing the malicious link
• Compromised legitimate websites (watering hole attacks)
• Malicious advertisements (malvertising) that redirect to the exploit page
• QR codes in physical locations or PDF attachments

The target is any Internet user running Chrome prior to version 152.0.7977.65.

Step 2 — Triggering the Flaw

The victim clicks the link and the crafted HTML page loads in Chrome. The page contains specific HTML/CSS/JavaScript constructs that exercise the Paint component in a way that triggers the incorrect authorization check. Because the vulnerability is in the rendering pipeline, the mere act of rendering the page — without requiring additional user interaction — may be sufficient to trigger the flaw.

Note: No public PoC exists; the exact HTML constructs required to trigger the vulnerability are unknown. The attack chain is inferred from the vulnerability class.

Step 3 — Payload / Execution Method

The crafted HTML page exploits the Paint component's flawed authorization logic to bypass origin policy checks. At the vulnerability-class level, this means the page can now:

• Issue cross-origin fetches and read the responses (same-origin policy is not enforced)
• Read the content of iframes from other origins
• Access local storage, cookies, or other origin-scoped data belonging to different sites
• Potentially interact with browser extensions or internal Chrome pages that rely on origin isolation

The payload is entirely client-side JavaScript embedded in the HTML page; no server-side component is needed beyond hosting the malicious content.

Step 4 — Post-Exploitation Impact

Once origin policy is bypassed, the attacker can:

• Steal session tokens and authentication cookies from any site the user is logged into
• Exfiltrate sensitive data displayed in other tabs (e.g., banking portals, email, corporate SaaS apps)
• Perform actions on behalf of the user in other web applications using the stolen session information
• Pivot to further exploitation if the user has access to internal web-based systems (e.g., admin consoles)

No public exploit code exists at the time of writing, and the vulnerable Paint behavior was likely a logic error rather than a memory corruption issue, making exploitation reliability dependent on the specific authorization check that failed. Attack chain is inferred from vulnerability class; no public PoC available.

Impact Assessment

Business Impact

• Confidentiality: HIGH — SOP bypass directly leads to cross-origin data theft, including credentials, session cookies, and sensitive business documents viewed in the browser.
• Integrity: MEDIUM — An attacker could modify data in web applications by replaying stolen sessions, potentially altering financial records, CRM data, or email communications.
• Availability: LOW — This is a data theft/authorization bypass flaw; no denial-of-service impact identified.

Affected Systems

Any organization deploying Google Chrome versions prior to 152.0.7977.65 across endpoints, including:

• Managed Windows/macOS/Linux workstations
• Android mobile devices using Chrome as the default browser
• ChromeOS devices
• Virtual desktop infrastructure (VDI) environments running Chrome
• Kiosk or dedicated browsers embedded in applications

Blast Radius

The vulnerability is client-side; the blast radius is limited to the victim's browser session and the data accessible through it. However, in enterprise environments where users access internal web applications, the blast radius extends to whatever the victim is authorized to view. Given that Chrome is the most widely used web browser globally, the potential target pool is massive, though exploitation requires user interaction (visiting a malicious page).

CVSS Considerations

CVSS score is not available (N/A). Chromium security severity is rated High. Based on the attack vector (network via crafted page), low complexity, and high confidentiality impact typical of SOP bypasses, a realistic CVSS would likely fall in the 8.2–9.6 range; however, no official score is published, and we do not override the N/A designation.

Detection Guidance

Sigma Rule

title: Chrome Paint SOP Bypass - CVE-2026-79093
id: 6f8a2f2e-5c6a-4c5b-9a8b-6f3e2a1d4c5b
status: experimental
description: Detects Chrome versions prior to 152.0.7977.65 that may be vulnerable to CVE-2026-79093
author: valtersit Threat Intel
date: 2026/05/15
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\chrome.exe'
    filter_patched:
        ProductVersion|startswith: '152.0.7977.65'
    condition: selection and not filter_patched
level: medium
falsepositives:
    - Legitimate usage of older Chrome versions in restricted/offline environments
tags:
    - attack.t1189
    - cve.2026-79093

YARA Rule

rule CVE_2026_79093_Chrome_Paint_SOP_Bypass {
    meta:
        author = "valtersit Threat Intel"
        description = "Detects HTML/JS patterns indicative of origin policy bypass attempts against Chrome Paint"
        cve = "CVE-2026-79093"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79093"
        date = "2026-05-15"
        severity = "high"
    strings:
        $a = "crossOrigin" ascii
        $b = "postMessage" ascii
        $c = "contentWindow" ascii
        $d = "document.domain" ascii
        $e = "XMLHttpRequest" ascii
        $f = "fetch(" ascii
        $g = "outerHTML" ascii
    condition:
        filesize < 200KB and
        4 of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-79093 Chrome Paint SOP bypass attempt"; 
sid:2026079093; rev:1; 
flow:to_client,established; 
file.data; 
content:"crossOrigin"; nocase; 
content:"iframe"; nocase; distance:0; 
pcre:"/\b(crossOrigin|contentWindow|postMessage)\b/i"; 
classtype:attempted-user; 
metadata:cve CVE-2026-79093; 
reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79093;)

Elastic Detection

// Elastic EQL - Detect Chrome process spawning with anomalous network activity
sequence with maxspan=5m
  [ process where process.name == "googlechrome" and process.version < "152.0.7977.65" ]
  [ network where process.name == "googlechrome" and network.direction == "egress" and 
    destination.port in (80, 443) and 
    url.query != "" ]

Splunk SPL Query

index=proxy sourcetype=pan:traffic OR sourcetype=bluecoat:proxysg 
  url_stream OR url_contains 
  | search (url LIKE "%%iframe%%" OR url LIKE "%crossOrigin%") 
    AND NOT url_user_agent LIKE "%Chrome/152%" 
  | stats count by src_ip, dest_host, url 
  | where count > 5 
  | sort -count

Wazuh OSSEC Rule

<group name="chrome,">
  <rule id="100509" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">google-chrome|chrome</field>
    <match>crossOrigin|contentWindow|postMessage</match>
    <description>CVE-2026-79093: Potential Chrome Paint SOP bypass - cross-origin access attempt detected</description>
    <group>cve-2026-79093,</group>
    <mitre>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence

Confidence Level: 2/4 (CLAIMED) — A patch is claimed to exist in Chrome 152.0.7977.65 per NVD, but this is not independently confirmed. Verify with Google's official release notes before treating the patch as definitive.

1) Immediate Mitigations

• Block access to Chrome versions prior to 152.0.7977.65 — enforce minimum browser version via enterprise policies (Chromium's MinimumChromeVersion policy or MDM controls).
• Restrict browsing on high-risk endpoints to curated allowlists of trusted domains.
• Enable Chrome's Safe Browsing (default) to block known malicious pages.
• Disable or restrict cross-origin capabilities in enterprise web applications where feasible (e.g., enforce same-site cookie policies, X-Frame-Options, CSP).
• Deploy browser isolation solutions for high-risk users (finance, HR, admin) so HTML rendering occurs in a sanitized remote environment.

2) Patch / Upgrade Steps

1. Verify current version: Navigate to chrome://settings/help or check registry/GPO for installed version.
2. Roll out Chrome 152.0.7977.65 or later via:
   • Windows: Group Policy / SCCM / Intune
   • macOS: Jamf / Munki
   • Linux: Package manager (APT, YUM, RPM)
   • Mobile: MDM EMM tool
3. Enforce automatic updates: Set Chrome's update policy to auto-update (UpdateDefault policy) to prevent future delays.
4. Validate patch: Confirm all endpoints report Chrome ≥ 152.0.7977.65 within 48 hours of rollout.

3) Long-Term Hardening

• Adopt enterprise browser management tools (e.g., Google Admin Console for Chrome Browser Cloud Management) to enforce version minimums and update SLAs.
• Implement Zero Trust web access — require authentication/authorization for all web resources; do not rely solely on browser origin isolation.
• Educate users on phishing and drive-by download risks — this vulnerability requires visiting a malicious page.
• Monitor browser telemetry (vulnerability scanners, EDR browser extension events) for abnormal cross-origin activity.
• Establish a browser patching SLA of ≤ 7 days for High-severity Chromium vulnerabilities.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-79093
2. Chromium Security Center: https://chromereleases.googleblog.com/ (verify Chrome 152.0.7977.65 stable release notes)
3. CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
4. MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
5. CISA Known Exploited Vulnerabilities Catalog (confirms CVE-2026-79093 is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity

No known threat actor campaigns, exploit-in-the-wild evidence, or weaponized PoCs have been identified at the time of this report. The vulnerability is not in the CISA KEV catalog. However, given its High severity and drive-by nature, it aligns with patterns commonly exploited by initial-access brokers and ransomware operators who target browser vulnerabilities for foothold establishment. Monitor Chromium release notes and Google's security advisory for potential updates regarding active exploitation.