CVE-2026-79103: Incorrect reference resolution in Google Chrome

This vulnerability in Google Chrome's Speech feature involves incorrect reference resolution that can be exploited by a remote attacker with access to the renderer process. By crafting a malicious HTML page, the attacker can bypass site isolation protections, potentially allowing cross-site data access. The issue affects Chrome versions before 152.0.7977.65 and has been assigned CVE-2026-79103. The Chromium security team rates the severity as Medium internally, but the CVSS score reflects a low impact with network attack vector, high attack complexity, no privileges required, and user interaction needed. No known exploits are reported in the wild.

The vulnerability allows bypassing of site isolation, which is a security feature designed to prevent cross-site data leaks. However, exploitation requires prior compromise of the renderer process and user interaction, limiting the impact. The confidentiality impact is low, with no integrity or availability impact reported.

A fixed version of Google Chrome is available starting from 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.