Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and… (CVE-2026-79212)

CVE-2026-79212 describes a missing authorization issue in Google Chrome's password handling prior to version 152.0.7977.65. An attacker who has already compromised the renderer process can leverage social engineering and a specially crafted HTML page to bypass the web origin policy, potentially accessing password data without proper authorization. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and low confidentiality impact.

The vulnerability allows an attacker who has compromised the renderer process and successfully uses social engineering to bypass the web origin policy, potentially leading to unauthorized access to password data. The confidentiality impact is low, and there is no impact on integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are prior to 152.0.7977.65, updating to version 152.0.7977.65 or later is recommended once official patches are released. Monitor official Google Chrome security advisories for updates and apply patches promptly when available.