Race condition in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain… (CVE-2026-78991)

CVE-2026-78991 describes a race condition in the WebProtect feature of Google Chrome before version 152.0.7977.65. An attacker who has compromised the renderer process can exploit this condition via a specially crafted HTML page to access sensitive information. The vulnerability is classified under CWE-367 (Time-of-check Time-of-use Race Condition) and has a CVSS 3.1 base score of 5.3, indicating moderate impact. There is no information provided about an available patch or official remediation.

The vulnerability allows an attacker with control over the renderer process to obtain sensitive information from the browser. The impact is limited to confidentiality as integrity and availability are not affected. The attack requires user interaction (UI:R) and has a high attack complexity (AC:H), reducing the likelihood of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted web content and consider limiting exposure to potentially malicious HTML pages. Monitor official Google Chrome security advisories for updates regarding this vulnerability.