Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass… (CVE-2026-79088)

CVE-2026-79088 describes an incorrect authorization vulnerability in the FileSystem feature of Google Chrome versions before 152.0.7977.65. This flaw enables a remote attacker, through social engineering and a crafted HTML page, to bypass system access restrictions. The vulnerability does not impact confidentiality but can lead to integrity violations. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

The vulnerability allows an attacker to bypass system access restrictions, potentially enabling unauthorized modification or manipulation of data (integrity impact). There is no impact on confidentiality or availability. Exploitation requires user interaction via social engineering. No known active exploitation has been reported.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted HTML content and avoid social engineering attempts.