CVE-2026-79218: Incorrect authorization in Google Chrome

This vulnerability involves incorrect authorization in the sandbox mechanism of Google Chrome versions before 152.0.7977.65. An attacker who has already compromised the renderer process can leverage this flaw to escape the sandbox and execute arbitrary code on the host system. The CVSS score of 8.3 reflects the high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and user interaction required. The vulnerability is publicly disclosed and assigned CVE-2026-79218. No known exploits in the wild have been reported at this time.

Successful exploitation allows remote code execution outside the sandbox, potentially leading to full system compromise. The attacker must have already compromised the renderer process and trick the user into interacting with a crafted HTML page. The vulnerability affects confidentiality, integrity, and availability of the system.

Google has released a stable channel update for Chrome that addresses this vulnerability. Users should update to version 152.0.7977.65 or later to mitigate this issue. Patch status is not explicitly confirmed in the advisory, but the presence of the fixed version indicates remediation is available. Users should apply the update promptly. No additional vendor advisory states that no action is required.