CVE-2026-78946: Incorrect authorization in Google Chrome

This vulnerability involves incorrect authorization in the Select component of Google Chrome before version 152.0.7977.65. It enables a remote attacker to bypass the web origin policy, which is a fundamental security control that restricts how documents or scripts loaded from one origin can interact with resources from another origin. The issue can be triggered via a crafted HTML page. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, no privileges, and user interaction, with impact limited to integrity loss but no confidentiality or availability impact.

An attacker can bypass the web origin policy, potentially allowing unauthorized interactions between web origins that should be isolated. This could lead to limited integrity violations in the browser context. There is no impact on confidentiality or availability according to the CVSS vector. The severity is rated medium by Chromium security.

Google has released an official fix in Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.