CVE-2026-79010: Operation on a resource after expiration or release in Google Chrome

This vulnerability (CVE-2026-79010) affects Google Chrome versions before 152.0.7977.65. It is caused by an operation on a resource after expiration or release in the Network component. Exploitation requires that the attacker has already compromised the renderer process. Successful exploitation allows bypassing of the web origin policy, which is a security control that restricts how documents or scripts loaded from one origin can interact with resources from another origin. The vulnerability has a CVSS v3.1 base score of 4.3 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact.

An attacker who has compromised the renderer process can bypass the web origin policy, potentially allowing unauthorized access to resources or data that should be isolated by origin boundaries. The confidentiality impact is limited, and there is no impact on integrity or availability according to the CVSS vector. This could facilitate further attacks or data leakage within the browser context.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for more details and update instructions.