CVE-2026-78967: Missing authorization in Google Chrome

This vulnerability (CVE-2026-78967) affects Google Chrome versions before 152.0.7977.65 and is due to missing authorization in the BFCache component. An attacker with control over the renderer process can exploit this flaw by delivering a crafted HTML page to bypass system access restrictions. The issue is classified under CWE-862 (Missing Authorization). The CVSS 3.1 score is 6.5 (medium), reflecting a network attack vector with low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There are no known exploits in the wild. The vendor has released a fixed version 152.0.7977.65 to address this vulnerability.

The vulnerability allows an attacker who has already compromised the renderer process to bypass system access restrictions, potentially leading to unauthorized actions that affect the integrity of the system. There is no impact on confidentiality or availability. The attack requires user interaction and can be performed remotely over the network.

Users and administrators should update Google Chrome to version 152.0.7977.65 or later, where this vulnerability has been fixed. No other mitigations are indicated. Patch status is confirmed by the presence of the fixed version 152.0.7977.65. There is no indication of any temporary or alternative fixes.