Improper input validation in NTP Footer in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the… (CVE-2026-79123)

CVE-2026-79123 is an input validation vulnerability in the NTP Footer of Google Chrome on Windows before version 152.0.7977.65. It enables a remote attacker with control over the renderer process to bypass the web origin policy via a specially crafted HTML page. The issue is classified under CWE-20 (Improper Input Validation) and has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), indicating that exploitation requires user interaction but can lead to integrity impact without confidentiality or availability loss.

The vulnerability allows an attacker who has already compromised the renderer process to bypass the web origin policy, potentially enabling unauthorized actions or data manipulation within the browser context. There is no direct confidentiality or availability impact reported. The severity is moderate, reflecting the limited scope of exploitation requiring prior renderer compromise and user interaction.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update affected Chrome installations on Windows to this version or later to remediate the vulnerability. No additional mitigation steps are indicated.