CVE-2026-78961: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome's core authorization mechanism allows an attacker with control over the renderer process and the ability to socially engineer a user to bypass the web origin policy. The issue affects versions prior to 152.0.7977.65. The CVSS v3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact. No known exploits are reported in the wild. The vendor has published a stable channel update addressing this issue.

An attacker who has compromised the renderer process and successfully tricks a user can bypass the web origin policy, potentially exposing limited confidential information. There is no impact on integrity or availability. The vulnerability requires user interaction and prior compromise of the renderer process, limiting its exploitation scope.

Users and administrators should update Google Chrome to version 152.0.7977.65 or later, where this vulnerability is fixed. The vendor advisory confirms an official fix is available. No additional mitigation steps are indicated.