CVE-2026-79088: Incorrect authorization in Google Chrome

This vulnerability involves incorrect authorization in the FileSystem feature of Google Chrome versions before 152.0.7977.65. An attacker can craft a malicious HTML page that, when visited by a user, can bypass system access restrictions due to improper authorization checks. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality and integrity.

Exploitation can lead to unauthorized access to system resources that should be restricted, potentially exposing limited confidential information or allowing limited unauthorized modification of data. There is no impact on system availability. The attack requires user interaction via social engineering, reducing the likelihood of automated exploitation.

Google has released an update in Chrome version 152.0.7977.65 addressing this vulnerability. Users and administrators should update to this version or later to remediate the issue. Patch status is not explicitly confirmed in the advisory, but the presence of the version number indicates the fix is included in 152.0.7977.65. Refer to the official Google Chrome stable channel update blog for confirmation and update instructions: https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html