CVE-2026-79255: Improper input validation in Google Chrome

This vulnerability in Google Chrome WebRTC arises from improper input validation, enabling an attacker with control over the renderer process to bypass the web origin policy. The flaw affects versions of Chrome before 152.0.7977.65. The web origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy could potentially allow unauthorized access to web content boundaries. The CVSS score of 3.1 reflects a low severity, indicating limited impact and exploitation complexity.

The impact is limited to confidentiality as the vulnerability allows bypassing the web origin policy, potentially exposing data across origins. There is no impact on integrity or availability. Exploitation requires prior compromise of the renderer process and user interaction (UI required). The attack complexity is high, and no known exploits are reported in the wild.

A fixed version of Google Chrome is available at 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory confirms the availability of this update. No additional mitigation steps are indicated.