Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to… (CVE-2026-79174)

CVE-2026-79174 is an authorization bypass vulnerability in the Extensions component of Google Chrome versions prior to 152.0.7977.65. It allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy and access privileged pages through a crafted HTML page. The vulnerability is categorized under CWE-863 (Incorrect Authorization). The CVSS 3.1 base score is 4.3, indicating a medium severity impact primarily affecting confidentiality with no impact on integrity or availability.

The vulnerability allows an attacker with control over the renderer process to bypass web origin policy restrictions and access privileged pages within the browser. This could lead to limited information disclosure but does not affect integrity or availability. There are no known exploits in the wild according to the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor official Google Chrome security advisories for updates addressing this vulnerability.