Missing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML… (CVE-2026-79110)

CVE-2026-79110 is a vulnerability in Google Chrome's Preload functionality before version 152.0.7977.65. The flaw involves missing authorization checks that enable a remote attacker to bypass the web origin policy by delivering a specially crafted HTML page. The web origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. This vulnerability could lead to unauthorized access to information across origins, classified as a confidentiality impact with no integrity or availability impact. The CVSS 3.1 base score is 4.3, indicating a moderate risk level. There is no information provided about an official patch or vendor advisory, and no known exploits in the wild have been reported.

The vulnerability allows remote attackers to bypass the web origin policy, potentially exposing confidential information across web origins. However, it does not affect data integrity or system availability. The impact is limited to confidentiality loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor official Google Chrome security advisories for updates and apply any forthcoming patches promptly. Until a patch is available, cautious handling of untrusted HTML content and limiting exposure to potentially malicious web pages may reduce risk.