Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted network… (CVE-2026-79208)

CVE-2026-79208 describes a vulnerability in Google Chrome's HTTP2 handling where missing authorization checks enable a remote attacker to leak sensitive information by sending specially crafted network traffic. This vulnerability affects versions of Chrome prior to 152.0.7977.65. The flaw is categorized under CWE-862 (Missing Authorization) and has a moderate severity rating with a CVSS 3.1 base score of 5.9, indicating a network attack vector with high complexity and no privileges or user interaction required. There is no indication of known exploits in the wild or vendor patch links provided in the input data.

The vulnerability allows an unauthenticated remote attacker to leak sensitive information from affected versions of Google Chrome via crafted HTTP2 network traffic. The impact is limited to confidentiality loss without integrity or availability effects. The CVSS vector indicates a network attack with high complexity and no privileges or user interaction needed, but the overall severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided in the input data, users should monitor official Google Chrome security advisories for updates and apply the update to version 152.0.7977.65 or later once available.