CVE-2026-79258: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome's WebXR implementation allows a remote attacker to bypass authorization controls and access cross-origin data by tricking a user into visiting a maliciously crafted HTML page. The flaw is classified under CWE-863 (Incorrect Authorization). The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. The issue affects Chrome versions prior to 152.0.7977.65.

An attacker can obtain sensitive cross-origin data from a victim's browser by exploiting this authorization flaw in WebXR, potentially leading to confidentiality breaches. There is no impact on integrity or availability. Exploitation requires user interaction via social engineering. No known exploits are reported in the wild.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side browser issue, patching the affected Chrome installations is the recommended mitigation.