Improper input validation in ReadingList in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the… (CVE-2026-79243)

CVE-2026-79243 is an input validation vulnerability in the ReadingList feature of Google Chrome on Windows before version 152.0.7977.65. A remote attacker with control over the renderer process can exploit this flaw to bypass the web origin policy by delivering a specially crafted HTML page. The Chromium security team has assigned a low severity rating internally, but the CVSS score reflects a moderate impact due to the potential integrity impact without confidentiality or availability loss.

The vulnerability allows an attacker who has already compromised the renderer process to bypass the web origin policy, potentially enabling unauthorized actions or data manipulation within the browser context. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

A fix is available in Google Chrome version 152.0.7977.65 and later. Users and administrators should update affected Chrome installations on Windows to this version or newer to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.