Incorrect authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and… (CVE-2026-78961)

CVE-2026-78961 is an authorization bypass vulnerability in Google Chrome's Core component affecting versions before 152.0.7977.65. A remote attacker who has already compromised the renderer process can exploit this flaw by leveraging social engineering to bypass the web origin policy through a specially crafted HTML page. This vulnerability is categorized under CWE-863 (Incorrect Authorization). The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction, and resulting in limited confidentiality impact without integrity or availability impact.

The vulnerability allows an attacker who has compromised the renderer process to bypass the web origin policy, potentially exposing limited confidential information. There is no impact on integrity or availability. The attack requires user interaction and a crafted HTML page. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users and administrators should monitor official Google Chrome security advisories for updates addressing this issue. Until a fix is available, exercising caution with untrusted web content and minimizing renderer process compromise risk are prudent.