CVE-2026-79005: Incorrect authorization in Google Chrome

This vulnerability involves incorrect authorization in the StorageAccessAPI component of Google Chrome before version 152.0.7977.65. An attacker with control over the renderer process can exploit this flaw to bypass the web origin policy, potentially leading to unauthorized actions or information disclosure within the browser context. The issue is classified with a medium severity level and a CVSS 3.1 score of 6.5, reflecting a network attack vector with low attack complexity, no privileges required, but requiring user interaction. The impact is limited to integrity, with no confidentiality or availability impact noted. Google has issued an official fix in Chrome version 152.0.7977.65.

The vulnerability allows an attacker who has already compromised the renderer process to bypass the web origin policy, potentially enabling unauthorized actions that affect the integrity of web content or browser behavior. There is no direct impact on confidentiality or availability. No known exploits are reported in the wild.

An official fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.