CVE-2026-78898: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome's Downloads feature allows a remote attacker to bypass system access restrictions by tricking a user into interacting with a maliciously crafted HTML page. The flaw is due to incorrect authorization checks. It affects Chrome versions before 152.0.7977.65. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low complexity, no privileges required, user interaction needed, unchanged scope, and limited confidentiality and integrity impact. No known exploits in the wild have been reported. The vendor has published an advisory but has not explicitly stated the remediation level or patch availability in the provided data.

Successful exploitation could allow an attacker to bypass system access restrictions related to the Downloads feature in Chrome, potentially leading to limited unauthorized access to user data or actions. The impact is limited to confidentiality and integrity with no availability impact. Exploitation requires user interaction and social engineering.

The vendor advisory link indicates a stable channel update for Chrome but does not explicitly confirm patch availability in the provided data. Users should update to Chrome version 152.0.7977.65 or later to mitigate this vulnerability. Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance.