CVE-2026-79260: Improper input validation in Google Chrome

This vulnerability in Google Chrome's cookie handling allows improper input validation that can be exploited by an attacker with control over the renderer process to bypass the web origin policy. The flaw exists in versions prior to 152.0.7977.65. The CVSS score is 6.5 (medium severity) with an attack vector of network, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vendor advisory is available but does not specify if a fix has been released.

An attacker who has already compromised the renderer process can exploit this vulnerability to bypass the web origin policy, potentially leading to unauthorized access to sensitive information within the browser context. The impact is limited to confidentiality and does not affect integrity or availability. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted content and consider updating to the latest Chrome version once available.