CVE-2026-84332: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome's SiteSettings prior to version 152.0.7977.75 allows a remote attacker to bypass system access restrictions by leveraging incorrect authorization checks. The issue is triggered through a crafted HTML page, enabling unauthorized modification or actions that compromise the integrity of the system. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker can remotely bypass authorization controls in Chrome's SiteSettings, potentially allowing unauthorized changes that affect system integrity. There is no impact on confidentiality or availability. No known exploits are reported in the wild at this time.

A fixed version of Google Chrome is available starting from 152.0.7977.75. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html for details.