Incorrect authorization in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a… (CVE-2026-79093)

CVE-2026-79093 describes an incorrect authorization vulnerability in the Paint component of Google Chrome versions before 152.0.7977.65. This flaw could enable a remote attacker to bypass the web origin policy by leveraging a specially crafted HTML page. The vulnerability is rated with a CVSS 3.1 score of 4.3 (medium severity) and is related to improper authorization checks (CWE-863). There is no evidence of active exploitation, and no official patch or remediation details are currently available.

The vulnerability could allow a remote attacker to bypass the web origin policy, potentially leading to unauthorized access to web resources or data that should be restricted by origin. The impact is limited to confidentiality (partial information disclosure) with no integrity or availability effects reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when visiting untrusted web pages and consider applying any available security updates from Google Chrome promptly once they become available.