CVE-2026-79184: Missing authorization in Google Chrome

This vulnerability in Google Chrome's Preload component allows an attacker with control over the renderer process to bypass the web origin policy by crafting a malicious HTML page. The issue is due to missing authorization checks. It affects Chrome versions prior to 152.0.7977.65. The CVSS 3.1 base score is 4.3, indicating a medium severity level. The vulnerability does not impact confidentiality, integrity, or availability beyond the limited scope of the origin policy bypass. No official remediation level or patch is explicitly stated in the provided data, but the affected version is identified, and a vendor advisory URL is provided for reference.

An attacker who has already compromised the renderer process can bypass the web origin policy, potentially allowing unauthorized access to web content that should be restricted by origin boundaries. The impact is limited to confidentiality with no direct impact on integrity or availability. The vulnerability requires user interaction (UI:R) and network attack vector (AV:N) with no privileges required (PR:N).

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance. Until an official fix is confirmed, users should ensure they run the latest stable Chrome version and follow standard security best practices. No specific temporary mitigations are provided in the available data.