Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a… (CVE-2026-79038)

CVE-2026-79038 is an authorization bypass vulnerability in the WebProtect feature of Google Chrome versions before 152.0.7977.65. This flaw enables a remote attacker to gain access to sensitive information by leveraging improper authorization checks when processing crafted HTML content. The vulnerability is classified under CWE-863 (Incorrect Authorization) and has a CVSS 3.1 base score of 6.5, indicating a moderate impact primarily on confidentiality. There is no indication of active exploitation in the wild or a vendor-provided patch link in the provided data.

Successful exploitation allows a remote attacker to obtain sensitive information from the affected Chrome browser without requiring privileges or causing denial of service. The integrity and availability of the system are not impacted. The vulnerability could lead to information disclosure via crafted HTML content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix link is provided, users should monitor official Google Chrome security advisories for updates and apply the update to version 152.0.7977.65 or later once available.