Missing authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to… (CVE-2026-78968)

CVE-2026-78968 describes a missing authorization issue in the core component of Google Chrome before version 152.0.7977.65. This flaw enables a remote attacker, who has already compromised the renderer process, to potentially spoof the browser's address bar by using a crafted HTML page. The vulnerability is categorized under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

The vulnerability allows an attacker with control over the renderer process to spoof the address bar, potentially misleading users about the actual URL they are visiting. This could facilitate phishing or other social engineering attacks by making malicious sites appear legitimate. There is no direct confidentiality or availability impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fix information is provided, users and administrators should monitor official Google Chrome security advisories for updates. Until a fix is available, limiting exposure to untrusted content and maintaining updated security controls is advisable.