---
id: CVE-2026-79006
title: >-
  chromium-browser: Google Chrome: Web origin policy bypass via crafted network
  traffic (CVE-2026-79006)
summary: >-
  A flaw was found in Google Chrome. This vulnerability, located in the
  HttpsUpgrades component, allows a remote attacker to bypass the web origin
  policy. By sending specially crafted network traffic, an attacker could
  circumvent security re…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-693
vendor: Red Hat
product: Chrome
affected:
  - Chrome >= 152.0.7977.65 < 152.0.7977.65
published: '2026-08-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T07:40:42+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79006.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79006.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-79006'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-79006'
  - url: >-
      https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html
  - url: 'https://issues.chromium.org/issues/502344135'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00246
epssPercentile: 0.15839
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-27T19:28:54.482708Z'
ingestedAt: '2026-09-17T23:31:20.812Z'
---

## Overview

A flaw was found in Google Chrome. This vulnerability, located in the HttpsUpgrades component, allows a remote attacker to bypass the web origin policy. By sending specially crafted network traffic, an attacker could circumvent security restrictions designed to isolate content from different websites, potentially leading to unauthorized access or manipulation of data.

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79006.json)

**chromium-browser: Google Chrome: Web origin policy bypass via crafted network traffic**. Released 2026-08-25, updated 2026-09-25.

Not affected:

- All currently supported Red Hat products

## Remediation

Refer to the advisory for fix availability.