CVE-2026-79123: Improper input validation in Google Chrome

This vulnerability in Google Chrome (Windows) prior to version 152.0.7977.65 stems from improper input validation in the NTP Footer. An attacker who has already compromised the renderer process can exploit this flaw to bypass the web origin policy by using a specially crafted HTML page. The issue is classified with a medium severity and a CVSS 3.1 base score of 6.5, indicating a network attack vector with low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor has released an official fix in version 152.0.7977.65.

An attacker who has compromised the renderer process in affected versions of Chrome on Windows can bypass the web origin policy, potentially allowing unauthorized actions that compromise the integrity of web content. There is no impact on confidentiality or availability. The vulnerability requires user interaction and network access but no privileges.

Users and administrators should update Google Chrome on Windows to version 152.0.7977.65 or later to remediate this vulnerability. The vendor has provided an official fix. No additional mitigations are indicated by the vendor advisory.