CVE-2026-76019: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome's Workers component allows an attacker with control over the renderer process and the ability to perform social engineering to bypass the web origin policy. This flaw affects versions of Chrome before 151.0.7922.173. The issue is categorized as incorrect authorization, which can lead to unauthorized access across web origins. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts.

An attacker who has compromised the renderer process and can trick a user via social engineering may bypass the web origin policy, potentially leading to unauthorized access to sensitive data or actions across web origins. This can compromise confidentiality and integrity of user data within the browser context.

A stable channel update for Google Chrome version 151.0.7922.173 or later addresses this vulnerability. Users and administrators should update Chrome to version 151.0.7922.173 or newer to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.