CVE-2026-79249: Code injection in Google Chrome

This vulnerability involves code injection in the Bisection component of Google Chrome versions before 152.0.7977.65. An attacker can exploit this by delivering a specially crafted file that triggers the injection, enabling unauthorized access to sensitive information. The CVSS v3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vulnerability is publicly disclosed with no confirmed exploits in the wild. The vendor advisory link exists but does not explicitly state if a patch or fix is available.

Successful exploitation allows a remote attacker to obtain sensitive information from the affected Chrome browser without requiring privileges but does require user interaction. There is no impact on integrity or availability. The confidentiality impact is high, meaning sensitive data could be exposed.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance. Until official confirmation, users should update to the latest Chrome version once available. No specific temporary mitigations are provided.