CVE-2026-78954: Incorrect authorization in Google Chrome

This vulnerability (CVE-2026-78954) affects Google Chrome versions before 152.0.7977.65. It involves incorrect authorization checks in the Extensions component, enabling an attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page. The web origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. The flaw is rated with a CVSS 3.1 base score of 4.3 (medium severity), indicating limited impact on confidentiality and no impact on integrity or availability. The issue was publicly disclosed and patched by Google in the stable channel update 152.0.7977.65.

An attacker who has compromised the renderer process can bypass the web origin policy, potentially allowing unauthorized access to web resources across origins. However, the impact is limited to confidentiality loss and does not affect integrity or availability. There are no known exploits in the wild at the time of disclosure.

A fixed version is available. Users and administrators should update Google Chrome to version 152.0.7977.65 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.