CVE-2026-78947: Incomplete cleanup in Google Chrome

This vulnerability arises from incomplete cleanup in Chromium within Google Chrome versions before 152.0.7977.65. It enables a remote attacker to bypass the web origin policy by leveraging social engineering techniques and a specially crafted Chrome extension. The issue is classified with a medium severity level and a CVSS score of 6.5, indicating a moderate impact primarily on integrity. The vendor has published an advisory and released a stable channel update to fix this vulnerability.

An attacker can bypass the web origin policy, potentially allowing unauthorized actions or data manipulation within the browser context. The integrity of web content can be compromised, but confidentiality and availability are not affected. Exploitation requires user interaction (UI:R) and social engineering to install a malicious extension. No active exploits have been reported.

A fixed version of Google Chrome is available at 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for detailed update instructions.