CVE-2026-79199

Executive Summary

CVE-2026-79199 is an incorrect authorization vulnerability in the Network component of Google Chrome, affecting all versions prior to 152.0.7977.65. A remote attacker can exploit this flaw by luring a victim to a crafted HTML page, thereby bypassing system access restrictions enforced by the browser's permission and network policy layer. The vulnerability carries a Chromium security severity rating of Medium, with a CVSS base score of 4.3 due to low integrity impact and a requirement for user interaction. No public proof-of-concept, exploit code, or active exploitation has been reported as of the time of analysis, nor is the CVE listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Technical Analysis

The vulnerability is classified under CWE-863 (Incorrect Authorization), which indicates that the software fails to perform adequate authorization checks when a user attempts to perform an action. In the context of Chrome's Network component, this translates to a failure in enforcing system access restrictions — policies that govern what network resources a web page is permitted to reach.

While the NVD description lacks code-level specifics regarding the exact function or code path involved, the vulnerability class is clear: certain network-related permission checks are either skipped entirely or evaluated incorrectly when conditions are triggered by a crafted HTML page. The attack vector is remote (AV:N), requires no prior authentication (PR:N), and demands low attack complexity (AC:L), meaning no special conditions or race conditions are necessary for exploitation. However, user interaction (UI:R) is mandatory — the victim must navigate to or render the malicious HTML page, typically via social engineering, malvertising, or a compromised legitimate site.

The impact is limited to integrity (C:N/I:L/A:N): the attacker does not gain confidentiality or availability impact, but can modify the intended behavior of network access controls. This suggests the flaw enables actions such as making requests to local network resources, bypassing mixed-content blocking, or circumventing private network access (PNA) checks. The EPSS score of 0.00243 (15.3rd percentile) indicates the vulnerability is not currently being actively exploited in the wild.

Careful consideration of the description's wording — "bypass system access restrictions" — points to the browser's network permission model being subverted, potentially allowing a remote page to reach resources it should not be able to access, such as localhost services, intranet endpoints, or loopback addresses. Without patch-level detail, the exact bypass mechanism remains inferential; however, the attack surface is user-facing and browser-mediated.

Exploitation Scenarios

No public PoC or exploit code is available; the following attack chain is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance and Target Selection: A malicious actor crafts an HTML page designed to trigger the authorization bypass. The page may be hosted on a compromised website, served via a phishing link, or embedded in an iframe on a high-traffic page. The attacker's objective is to have a Chrome user (version < 152.0.7977.65) visit this page.

Step 2 — Triggering the Flaw: Upon the victim's browser parsing the HTML payload, the Network component processes requests governed by access restrictions. The crafted page leverages the authorization flaw to bypass these checks. Due to the lack of specific function names in the public description, the exact trigger is not known; however, the flaw class suggests malformed or edge-case network request headers, special URL schemes, or behavioral discrepancies between how the browser validates and how it performs the request.

Step 3 — Payload/Execution: The HTML page may include JavaScript that makes network requests to restricted endpoints after the authorization bypass is activated. Since the flaw is in the Network component and classified as incorrect authorization, the execution is a lateral access attempt rather than code execution: the page gains the ability to interact with resources that the browser's policy engine should block.

Step 4 — Post-Exploitation Impact: With integrity-only impact, the attacker can cause the user's browser to send requests to network resources (e.g., internal services, router admin pages, or other localhost-based applications). Although not a direct data exfiltration (no confidentiality impact), this can enable CSRF-style attacks against intranet services, DNS rebinding-style abuse, or one-way service disruption via malformed requests sent to internal endpoints.

Impact Assessment

Business Impact: The primary business risk is to organizations whose employees browse the web using Chrome versions prior to 152.0.7977.65. An attacker who successfully triggers this flaw gains the ability to send crafted requests from the victim's browser to internal network resources. This can be used to issue unauthorized commands to unauthenticated internal services, cause state changes in web applications that rely on implicit network trust, or probe internal infrastructure for reconnaissance. The integrity impact (I:L) indicates that the compromise is limited to altering data or state without full system takeover.

Affected Systems: Chrome on all platforms (Windows, macOS, Linux) running versions prior to 152.0.7977.65. Enterprise-managed Chrome installations that delay feature updates are at elevated risk.

Blast Radius: Low-to-moderate. The vulnerability requires active user interaction, yields no RCE, and exposes no persistent backdoor. However, in environments with inadequately secured internal services, the attacker's ability to originate requests from a trusted browser context may be leveraged to reach services that would otherwise be protected by network segmentation, effectively converting a client-side flaw into an internal network access tool.

CVSS Subscore Analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N decodes to Network attack vector (exploitable remotely), Low attack complexity (no specialized conditions), No privileges required, User interaction required, Unchanged scope (the compromised component is not isolated), and limited Integrity impact. This classification correctly reflects a medium-severity client-side vulnerability with limited direct impact.

Detection Guidance

Sigma Rule

title: Chrome Network Authorization Bypass - CVE-2026-79199
id: 7a2c8f1e-9d63-4b7e-b0a4-3f5f8e2c7b6a
status: experimental
description: Detects Chrome processes attempting network connections that may indicate a CVE-2026-79199 authorization bypass attempt via crafted HTML.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: 
            - '\\chrome.exe'
            - '\\chrome'
        CommandLine|contains:
            - '--disable-features='
            - '--allow-running-insecure-content'
        IntegrityLevel:
            - 'Medium'
    condition: selection
    timeframe: 60s
level: medium
falsepositives:
    - Legitimate Chrome enterprise configurations using policy flags
    - Development environments with intentionally relaxed security settings
tags:
    - attack.t1548
    - cve.2026.79199
    - cwe.863

YARA Rule

rule CVE_2026_79199_Chrome_Network_Bypass
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects HTML/JS patterns commonly seen in Crafted pages targeting CVE-2026-79199"
        cve = "2026-79199"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $html_tag = "<iframe" nocase
        $js_fetch = "fetch(" nocase
        $js_xhr = "XMLHttpRequest" nocase
        $local_target = "127.0.0.1" nocase
        $local_target2 = "localhost" nocase
        $internal_ip = /(192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)/ nocase
        $pna_bypass = "private" nocase
        $ws_conn = "WebSocket" nocase
    condition:
        2 of them and ($html_tag or $js_fetch or $js_xhr)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-79199 - Chrome Network Authorization Bypass Attempt";
    content:"GET"; http_method;
    content:"Host: "; http_header;
    pcre:"/Host:\s*(127\.0\.0\.1|localhost|10\.|192\.168\.)/i";
    flow:to_server,established;
    classtype:attempted-admin;
    sid:202679199;
    rev:1;
    metadata:created_at 2026_01_01, cve 2026-79199, severity medium;
)

Elastic Detection

network where
  process.name == "chrome" and
  network.direction == "egress" and
  (
    destination.ip == "127.0.0.1" or
    destination.ip.startsWith("10.") or
    destination.ip.startsWith("192.168.") or
    destination.ip.startsWith("172.16.") or
    destination.ip.startsWith("172.17.") or
    destination.ip.startsWith("172.18.") or
    destination.ip.startsWith("172.19.") or
    destination.ip.startsWith("172.2") or
    destination.ip.startsWith("172.3") or
    destination.ip.startsWith("172.4") or
    destination.ip.startsWith("172.5") or
    destination.ip.startsWith("172.6") or
    destination.ip.startsWith("172.7") or
    destination.ip.startsWith("172.8") or
    destination.ip.startsWith("172.9") or
    destination.ip.startsWith("172.1") or
    destination.ip.startsWith("172.0")
  ) and
  not destination.port in (53, 80, 443)

Splunk SPL Query

index=network sourcetype=netflow OR index=proxy sourcetype=pan:traffic
| search user_agent="*Chrome*"
| where like(dest_ip, "127.%") OR like(dest_ip, "10.%") OR 
    like(dest_ip, "192.168.%") OR 
    (mvfind(dest_ip, "^172\.(1[6-9]|2[0-9]|3[0-1])\.") != "")
| where NOT dest_port IN (80, 443, 53)
| table _time, src_ip, dest_ip, dest_port, url, user_agent
| stats count by src_ip, dest_ip, dest_port

Wazuh OSSEC Rule

<group name="chrome_network_bypass,">
  <rule id="100791" level="8">
    <decoded_as>json</decoded_as>
    <field name="process.name">chrome</field>
    <field name="network.direction">egress</field>
    <regex>127\.0\.0\.1|10\.[0-9]+\.|192\.168\.</regex>
    <description>CVE-2026-79199: Chrome attempting internal network connection - potential authorization bypass</description>
    <mitre>
      <id>T1548</id>
    </mitre>
    <group>cve-2026-79199,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The patch is claimed by NVD but not independently confirmed by a second authoritative source. Organizations retain the patch bulletin as trustable but unverified.

Immediate Mitigations:

1. Update Chrome to version 152.0.7977.65 or later as soon as feasible. Verify the patch is applied via chrome://version after update.
2. If immediate update is impossible, restrict user browsing to trusted sites and consider deploying a URL-filtering proxy to block suspicious or uncategorized domains.
3. Enable Chrome's "Always use secure connections" setting to reduce exposure to malicious pages over HTTP, which are common delivery vectors for crafted HTML.
4. Review network policy: ensure the browser context is not granted implicit access to sensitive internal resources that a single request from a browser tab could alter.

Patch/Upgrade Steps:

1. For enterprise-managed devices, push the update via Google Update or your centralized software deployment tool (e.g., Microsoft SCCM, WSUS, or MDM profile).
2. For standalone users: Chrome → Settings → About Chrome → "Relaunch" to apply the pending update.
3. Post-deployment, verify the browser version across endpoints using inventory scans.

Long-Term Hardening:

1. Adopt a structured browser update cadence that applies stable channel updates within 72 hours of release for security-sensitive roles.
2. Monitor the NVD and Chrome Releases blog for subsequent revisions to the advisory if the patch is retracted or refined.
3. Implement Private Network Access (PNA) protections at the network level — e.g., outbound firewall rules that enforce egress restrictions for end-user workstations, blocking direct access to RFC1918 addresses unless explicitly allowed.
4. Audit internal services for unauthenticated state-changing endpoints; any such endpoints should be considered reachable through browser-based request smuggling the moment a client-side flaw is exploited.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-79199
2. Google Chrome Releases (Official): https://chromereleases.googleblog.com/
3. Chromium Bug Tracker: https://bugs.chromium.org/p/chromium/issues/list
4. CWE-863 Reference: https://cwe.mitre.org/data/definitions/863.html
5. CISA KEV Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: As of the date of this report, there is no evidence of known threat actor campaigns exploiting CVE-2026-79199, no exploit-in-the-wild detections, and the CVE is not present on the CISA KEV list. The EPSS score of 0.00243 further corroborates a low likelihood of near-term weaponization.