CVE-2026-79065: Improper input validation in Google Chrome

This vulnerability in Google Chrome's network component arises from improper input validation that enables a remote attacker with control over the renderer process to bypass the web origin policy. The flaw exists in versions before 152.0.7977.65. The web origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy can lead to unauthorized access to information confined by origin boundaries. The CVSS v3.1 base score is 4.3 (medium), reflecting low confidentiality impact and no impact on integrity or availability. The vendor advisory linked indicates a stable channel update addressing this issue.

An attacker who has already compromised the renderer process can exploit this vulnerability to bypass the web origin policy, potentially gaining unauthorized read access to data from other origins. The impact is limited to confidentiality and does not affect integrity or availability. There are no reports of active exploitation in the wild.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side browser vulnerability, patching the browser is the primary mitigation. No additional vendor-recommended mitigations are indicated in the advisory.