CVE-2026-79066: Improper input validation in Google Chrome

This vulnerability (CVE-2026-79066) affects Google Chrome versions before 152.0.7977.65. It stems from improper input validation in the Navigation component, which can be exploited by a remote attacker who has already compromised the renderer process to bypass site isolation protections. Site isolation is a security feature designed to separate different websites into different processes to prevent data leakage. The CVSS v3.1 base score is 3.1, indicating low severity, with the attack vector being network, requiring high attack complexity, no privileges, and user interaction. The impact is limited to confidentiality with no integrity or availability impact. Google has released an official fix in version 152.0.7977.65 as noted in their stable channel update advisory.

An attacker who has compromised the renderer process can bypass site isolation protections, potentially allowing access to data from other sites in the same browser session. However, the impact is limited to confidentiality with no integrity or availability effects. The vulnerability requires user interaction and has a high attack complexity, reducing the likelihood of exploitation. There are no known exploits in the wild at this time.

Google has released an official fix for this vulnerability in Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the issue. No additional mitigation actions are indicated by the vendor advisory.