CVE-2026-79060: Incorrect authorization in Google Chrome

This vulnerability involves incorrect authorization in the StorageAccessAPI component of Google Chrome before version 152.0.7977.65. An attacker with control over the renderer process can exploit this flaw to bypass the web origin policy, potentially allowing unauthorized access to web resources. The issue is classified with a medium severity level and a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor has published a stable channel update that fixes this vulnerability.

An attacker who has compromised the renderer process can bypass the web origin policy, which may lead to unauthorized actions or data manipulation within the browser context. The confidentiality of data is not impacted, but the integrity of web content or actions can be compromised. There are no known exploits in the wild at this time.

Users should update Google Chrome to version 152.0.7977.65 or later, where this vulnerability has been fixed. The vendor advisory confirms the availability of an official fix. No additional mitigation steps are indicated.