CVE-2026-79191: Incorrect authorization in Google Chrome

This vulnerability involves incorrect authorization in the SiteIsolation component of Google Chrome before version 152.0.7977.65. An attacker who has already compromised the renderer process can leverage social engineering techniques with a crafted HTML page to bypass site isolation protections. The CVSS 3.1 vector indicates the attack requires network access, high attack complexity, no privileges, user interaction, and results in low confidentiality impact without affecting integrity or availability.

The vulnerability allows bypassing site isolation, potentially exposing some confidential information from other sites within the browser process. However, the impact is limited to confidentiality with no integrity or availability effects. Exploitation requires prior compromise of the renderer process and user interaction, reducing the likelihood and severity of attacks.

Google has released an official fix in Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.