CVE-2026-84331: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome's Actor component allows an attacker with control over the renderer process to bypass the web origin policy by using a crafted HTML page. The flaw is due to incorrect authorization checks. It affects Chrome versions prior to 152.0.7977.75. The CVSS score of 3.1 indicates low severity, reflecting limited impact primarily on confidentiality with no integrity or availability impact. The vendor advisory linked does not explicitly confirm a patch or remediation level.

An attacker who has already compromised the renderer process can bypass the web origin policy, potentially allowing unauthorized access to web content from different origins. The impact is limited to confidentiality with no known effect on integrity or availability. There are no known exploits in the wild, and the severity is rated low.

The vendor advisory linked does not explicitly confirm a patch or remediation status. Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html for current remediation guidance. Until a patch is confirmed, users should exercise caution with untrusted content and consider updating to the latest Chrome version once available.