CVE-2026-79289: Improper control of a resource through its lifetime in Google Chrome

This vulnerability in Google Chrome concerns improper management of a resource's lifetime within Workers, which are background scripts used by web pages. An attacker who has already compromised the renderer process could exploit this flaw to bypass site isolation protections by delivering a crafted HTML page. Site isolation is a security feature designed to separate different sites into different processes to prevent data leaks. The CVSS score of 3.1 reflects low severity, with the attack vector being network, requiring high attack complexity, no privileges, and user interaction. The vulnerability affects Chrome versions prior to 152.0.7977.65.

The impact is limited to a low severity bypass of site isolation protections in Chrome. This could potentially allow an attacker with control over the renderer process to access data from other sites that should be isolated. There is no indication of integrity or availability impact, and exploitation requires prior compromise of the renderer process and user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance. Since the affected version is identified as 152.0.7977.65, updating to this version or later is likely recommended. No explicit remediation level or patch link is provided in the input data.