CVE-2026-79093: Incorrect authorization in Google Chrome

CVE-2026-79093 is an authorization flaw in the Paint feature of Google Chrome before version 152.0.7977.65. This flaw allows a remote attacker to potentially bypass the web origin policy by crafting a malicious HTML page. The web origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. The vulnerability was assigned a medium severity with a CVSS v3.1 base score of 4.3, reflecting limited confidentiality impact and no integrity or availability impact. Google has released an official fix in Chrome version 152.0.7977.65 as documented in their stable channel update advisory.

The vulnerability could allow a remote attacker to bypass the web origin policy, potentially leading to unauthorized access to limited confidential information within the browser context. However, the impact is limited to confidentiality with no integrity or availability effects. There are no known exploits in the wild at this time.

Users and administrators should update Google Chrome to version 152.0.7977.65 or later to remediate this vulnerability. The vendor has provided an official fix as per the stable channel update advisory. No additional mitigations are required beyond applying the update.