Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to… (CVE-2026-78954)

CVE-2026-78954 describes an incorrect authorization vulnerability in the Extensions component of Google Chrome versions before 152.0.7977.65. A remote attacker who has already compromised the renderer process can exploit this flaw to bypass the web origin policy by using a specially crafted HTML page. The vulnerability is classified under CWE-863 (Incorrect Authorization). The CVSS 3.1 base score is 4.3, indicating a medium severity level, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact.

The vulnerability allows an attacker with control over the renderer process to bypass the web origin policy, potentially enabling unauthorized access to web content that should be restricted by origin boundaries. The impact is limited to confidentiality and does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor official Google Chrome security advisories for updates and apply updates promptly once available.