CVE-2026-79190: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome's extension authorization mechanism allows an attacker with control over the renderer process to bypass the web origin policy. The issue affects versions prior to 152.0.7977.65. The flaw is classified under CWE-863 (Incorrect Authorization). Exploitation requires the attacker to have already compromised the renderer process. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact.

An attacker who has compromised the renderer process can bypass the web origin policy, potentially allowing unauthorized access to web content that should be restricted by origin boundaries. The confidentiality impact is limited, with no integrity or availability impact reported. This could lead to information disclosure within the browser context.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.