CVE-2026-79031: Improper resource exposure in Google Chrome

This vulnerability in Google Chrome versions before 152.0.7977.65 involves improper resource exposure in the Preload functionality. An attacker can bypass site isolation protections by crafting a malicious HTML page, potentially accessing resources that should be isolated between sites. The CVSS 3.1 base score is 3.1 (low severity), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact. The issue was publicly disclosed and patched by Google in the stable channel update.

The vulnerability allows a remote attacker to bypass site isolation, potentially exposing resources across site boundaries. The impact is limited to confidentiality with no integrity or availability effects. The low CVSS score and absence of known exploits suggest limited practical risk if the browser is updated.

Google has released an official fix in Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are required beyond applying the official update.