Incorrect authorization in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML… (CVE-2026-79051)

CVE-2026-79051 is a vulnerability in Google Chrome's Loader component where improper authorization checks allow a remote attacker to bypass the web origin policy by delivering a crafted HTML page. This flaw affects versions of Chrome before 152.0.7977.65. The web origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy can lead to unauthorized access to some data but does not affect integrity or availability. The CVSS 3.1 base score is 4.3 (medium), reflecting the limited impact and ease of exploitation without privileges but requiring user interaction.

The vulnerability allows a remote attacker to bypass the web origin policy, potentially exposing some confidential information accessible via the browser's Loader component. There is no impact on data integrity or system availability. Exploitation requires user interaction (e.g., visiting a crafted HTML page). No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected version is prior to 152.0.7977.65, updating Google Chrome to version 152.0.7977.65 or later is recommended once the vendor confirms the fix. Until then, users should exercise caution when visiting untrusted web pages.