CVE-2026-79177: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome's Media component on Windows allows a remote attacker with control over the renderer process to bypass system access restrictions through crafted HTML content. The issue is due to incorrect authorization checks. The CVSS score is 6.5 (medium severity) with an attack vector of network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The affected version is prior to 152.0.7977.65. The vendor advisory link is available but does not explicitly state patch availability or remediation details.

An attacker who has already compromised the renderer process can bypass system access restrictions, potentially leading to integrity violations within the affected system. There is no impact on confidentiality or availability. The vulnerability requires user interaction and network access but no privileges. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance. Until official confirmation, users should update to version 152.0.7977.65 or later if available, as this version is indicated in the affectedVersions field. No other specific mitigations are provided.