CVE-2026-79021: Missing authorization in Google Chrome

This vulnerability (CVE-2026-79021) affects Google Chrome versions before 152.0.7977.65. It involves missing authorization in the InterestGroups component, which can be exploited by a remote attacker who has already compromised the renderer process. The attacker can bypass system access restrictions by delivering a crafted PDF file. The issue is classified with a medium severity and a CVSS 3.1 score of 6.5, indicating a network attack vector with low attack complexity, no privileges required, but requiring user interaction. The impact is high integrity loss without confidentiality or availability impact. Google has issued a stable channel update to fix this vulnerability in version 152.0.7977.65.

An attacker who has compromised the renderer process can bypass system access restrictions via a crafted PDF file, potentially leading to unauthorized actions that affect system integrity. There is no impact on confidentiality or availability according to the CVSS vector. The vulnerability is rated medium severity.

Google has released an official fix in Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. There are no indications that additional mitigations are required beyond applying this update.