CVE-2026-84355: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome's navigation component allows an attacker with control over the renderer process to bypass the web origin policy, which is a critical security mechanism that isolates different web origins. The issue affects versions prior to 152.0.7977.75. The CVSS score of 3.1 indicates low severity, with network attack vector, high attack complexity, no privileges required, and user interaction required. There is no indication of known exploits in the wild. The vendor advisory link is provided but does not explicitly state patch or remediation status.

A remote attacker who has already compromised the renderer process can bypass the web origin policy, potentially allowing unauthorized access to web content from different origins. However, the impact is limited by the requirement that the attacker must have control over the renderer process and user interaction is required. The confidentiality impact is low, with no integrity or availability impacts reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html for current remediation guidance. Since no explicit remediation level or patch link is provided, users should monitor official Google Chrome release notes and update to version 152.0.7977.75 or later when available.