CVE-2026-79261: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome versions before 152.0.7977.65 involves incorrect authorization in Controls, enabling a remote attacker to bypass the web origin policy via a crafted HTML page. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. The flaw is categorized as medium severity. No explicit remediation level or patch information is provided in the vendor advisory linked.

An attacker can bypass the web origin policy, potentially allowing unauthorized access to web resources or actions that should be restricted by origin. However, the impact is limited to integrity with no confidentiality or availability impact. User interaction is required for exploitation.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance. Until a patch is confirmed, users should exercise caution when interacting with untrusted web content that could exploit this vulnerability.