CVE-2026-79212: Missing authorization in Google Chrome

This vulnerability in Google Chrome (CVE-2026-79212) is due to missing authorization checks in the password management component. An attacker who has already compromised the renderer process and employs social engineering techniques can bypass the web origin policy by delivering a crafted HTML page. This flaw affects Chrome versions prior to 152.0.7977.65. The CVSS vector indicates the attack requires network access, low attack complexity, no privileges, user interaction, and results in low confidentiality impact without integrity or availability impact.

The impact is limited to a confidentiality loss of some information due to bypassing web origin policy protections. There is no integrity or availability impact. The attacker must have already compromised the renderer process and trick the user via social engineering, which limits the exploitability and scope of impact.

The vendor advisory URL indicates a stable channel update for desktop Chrome, implying that a fix is available in version 152.0.7977.65. Users should update to this version or later to remediate the vulnerability. No additional mitigation guidance is provided by the vendor advisory.