CVE-2026-79248: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome versions before 152.0.7977.65 is due to incorrect authorization in the Input component. An attacker who has already compromised the renderer process can exploit this flaw to bypass the web origin policy by delivering a specially crafted HTML page. The web origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. The CVSS v3.1 base score is 4.3, indicating a medium severity level. There are no known exploits in the wild as of the published date. The vendor advisory linked is the official source for remediation information.

The impact is limited to confidentiality loss (partial information disclosure) due to bypassing the web origin policy. There is no impact on integrity or availability. The attacker must have already compromised the renderer process to exploit this vulnerability, which limits the attack surface.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for detailed patch information.