CVE-2026-79002: Incorrect authorization in Google Chrome

This vulnerability involves incorrect authorization in the SiteIsolation component of Google Chrome versions before 152.0.7977.65. An attacker who has already compromised the renderer process can exploit this flaw to bypass site isolation protections via a specially crafted HTML page. SiteIsolation is designed to separate different sites into different processes to improve security, so bypassing it could reduce the effectiveness of this security boundary.

The impact is limited to confidentiality loss (partial information disclosure) as indicated by the CVSS vector (C:L, I:N, A:N). There is no impact on integrity or availability. The attacker must have already compromised the renderer process, so this vulnerability facilitates further privilege escalation within the browser sandbox environment.

A fixed version of Google Chrome is available at 152.0.7977.65 or later. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory confirms the fix in this stable channel update. No additional mitigation steps are required beyond applying the official update.