CVE-2026-78979: Race condition in Google Chrome

This vulnerability is a race condition in Google Chrome's Core on Windows platforms before version 152.0.7977.65. It enables a remote attacker to bypass the web origin policy by leveraging social engineering techniques and a specially crafted HTML page. The issue is classified under CWE-362 (Race Condition). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, and no integrity or availability impact.

An attacker can bypass the web origin policy, potentially allowing unauthorized access to web content or data that should be isolated by origin boundaries. The impact is limited to confidentiality with no integrity or availability effects. The vulnerability requires user interaction (social engineering) and does not require privileges, making exploitation possible but not trivial.

Users should update Google Chrome to version 152.0.7977.65 or later, where this vulnerability is addressed. Since the affected versions are prior to 152.0.7977.65, upgrading to this or a newer version mitigates the issue. No additional vendor advisory or patch link is provided, so users should monitor official Google Chrome release notes for confirmation.