CVE-2026-79134: Incorrect authorization in Google Chrome

This vulnerability concerns incorrect authorization checks in the GetUserMedia functionality of Google Chrome before version 152.0.7977.65. An attacker can exploit this flaw remotely by delivering a specially crafted HTML page that bypasses authorization controls, leading to unauthorized access to sensitive information. The CVSS v3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, user interaction needed, and high confidentiality impact without integrity or availability impact. The issue was publicly disclosed and patched by Google in the stable channel update 152.0.7977.65.

A remote attacker can obtain sensitive information from a victim's device without requiring privileges but with user interaction. The confidentiality of data accessible via GetUserMedia is compromised, but there is no impact on integrity or availability. No known exploits are reported in the wild at this time.

Users and administrators should update Google Chrome to version 152.0.7977.65 or later, where this vulnerability is fixed. No additional mitigation is required as the vendor has provided an official fix.