CVE-2026-78940: Improper initialization in Google Chrome

This vulnerability, identified as CVE-2026-78940, affects Google Chrome versions before 152.0.7977.65. It is caused by improper initialization in the network subsystem, enabling a remote attacker to bypass the web origin policy through a specially crafted HTML page. The web origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy could allow unauthorized access to certain web content. The CVSS v3.1 base score is 4.3, indicating a medium severity level, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact.

The impact is limited to confidentiality as the vulnerability allows bypassing the web origin policy, potentially exposing restricted web content to an attacker. There is no impact on integrity or availability. No known exploits are reported in the wild.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update announcement for details: https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html