CVE-2026-78941: Information leak in Google Chrome

This vulnerability in Google Chrome's core prior to version 152.0.7977.65 permits an attacker with control over the renderer process to bypass site isolation protections via a specially crafted HTML page, resulting in an information leak. Site isolation is a security feature designed to prevent cross-site data leaks by separating different sites into different processes. The flaw enables an attacker to circumvent this isolation, potentially exposing sensitive information. The CVSS score is 3.1, indicating low severity, with an attack vector of network, high attack complexity, no privileges required, user interaction required, and impact limited to confidentiality.

An attacker who has already compromised the renderer process can exploit this vulnerability to bypass site isolation and leak information. The impact is limited to confidentiality with no integrity or availability impact. The vulnerability is rated low severity and no known exploits in the wild have been reported.

Google has released Chrome version 152.0.7977.65 to address this vulnerability. Users and administrators should update to this version or later to mitigate the risk. Patch status is not explicitly confirmed in the advisory, but the fixed version is identified as 152.0.7977.65, so upgrading to this version or newer is recommended.