Missing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to… (CVE-2026-79184)

CVE-2026-79184 is a vulnerability in Google Chrome's Preload feature before version 152.0.7977.65. It involves missing authorization checks that enable a remote attacker, who has already compromised the renderer process, to bypass the web origin policy by using a specially crafted HTML page. This vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3 (medium severity), reflecting a low impact on confidentiality and no impact on integrity or availability.

The vulnerability allows bypassing the web origin policy, potentially exposing some confidential information accessible to the renderer process. However, it does not allow modification of data or disruption of service. The attack requires prior compromise of the renderer process, limiting the attack vector.

A fix is available in Google Chrome version 152.0.7977.65 and later. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.