Missing authorization in Lighthouse in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and… (CVE-2026-79053)

CVE-2026-79053 describes a missing authorization issue in the Lighthouse component of Google Chrome before version 152.0.7977.65. An attacker who has already compromised the renderer process can leverage social engineering to bypass site isolation protections by using a specially crafted HTML page. This vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 3.1, reflecting a low severity with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact.

The vulnerability allows a remote attacker with control over the renderer process and the ability to trick a user into interacting with a malicious page to bypass site isolation. This could potentially expose some data from other sites within the same browser process. However, the impact is limited to confidentiality with no integrity or availability effects reported.

A fix is available in Google Chrome version 152.0.7977.65 and later. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated.