CVE-2026-79186: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome (CVE-2026-79186) concerns incorrect authorization in the Network component that could allow a remote attacker, with control over the renderer process, to bypass site isolation protections by leveraging a crafted HTML page. The issue affects versions prior to 152.0.7977.65. The CVSS 3.1 base score is 3.1, indicating low severity, with attack vector network, high attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality. There is no explicit vendor advisory detail on remediation level or patch availability, but the affected version is identified as 152.0.7977.65, implying that this version addresses the issue.

The impact is limited to a low-severity bypass of site isolation protections, which could allow an attacker who already controls the renderer process to circumvent security boundaries between sites. There is no indication of direct data confidentiality, integrity, or availability impact beyond this bypass. No known active exploitation has been reported.

Since the vulnerability affects versions prior to 152.0.7977.65, updating Google Chrome to version 152.0.7977.65 or later is recommended to remediate this issue. The vendor advisory linked does not explicitly confirm patch status, so users should verify the update status via the official Chrome release notes. No additional mitigation steps are indicated.