Incorrect authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass… (CVE-2026-79178)

CVE-2026-79178 is an authorization bypass vulnerability in Google Chrome's Web Authentication feature affecting versions prior to 152.0.7977.65. The flaw allows a remote attacker to bypass the web origin policy by leveraging crafted HTML content, potentially enabling unauthorized access to web authentication credentials. The issue is classified under CWE-863 (Incorrect Authorization). The vulnerability has a CVSS v3.1 base score of 4.3, indicating moderate impact primarily on confidentiality with no impact on integrity or availability.

The vulnerability allows a remote attacker to bypass the web origin policy, potentially exposing some level of confidential information related to Web Authentication credentials (Passkeys & Security Keys). There is no reported impact on data integrity or system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor official Google Chrome security advisories and update to version 152.0.7977.65 or later once available to remediate this issue.