Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process… (CVE-2026-79191)

CVE-2026-79191 is an authorization bypass vulnerability in the SiteIsolation feature of Google Chrome versions before 152.0.7977.65. A remote attacker who has already compromised the renderer process can exploit this flaw by using social engineering techniques involving a crafted HTML page to bypass site isolation protections. This vulnerability is classified under CWE-863 (Incorrect Authorization). The CVSS v3.1 base score is 3.1, indicating low severity, with attack vector network, high attack complexity, no privileges required, user interaction required, and impact limited to confidentiality loss only.

The vulnerability allows a remote attacker who has compromised the renderer process and successfully tricks a user via social engineering to bypass site isolation, potentially leading to limited confidentiality loss. There is no impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users and administrators should monitor official Google Chrome security advisories for updates addressing this issue. Until a fix is available, cautious handling of untrusted content and minimizing social engineering risks are advisable.