Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted… (CVE-2026-78966)

CVE-2026-78966 describes a security flaw in Google Chrome's QUIC protocol handling before version 152.0.7977.65. The vulnerability allows a remote attacker to bypass the web origin policy by leveraging an externally controlled reference through a crafted HTML page. This can lead to unauthorized access to resources that should be restricted by the origin policy. The issue is rated as moderate severity by Chromium's security team and has a CVSS 3.1 base score of 4.3, indicating a low to medium impact primarily affecting confidentiality without integrity or availability impact.

The vulnerability enables a remote attacker to bypass the web origin policy, potentially allowing limited unauthorized access to web resources that are normally restricted. The impact is limited to confidentiality with no reported integrity or availability effects. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Users should monitor official Google Chrome security advisories for updates and apply any forthcoming patches promptly.