Bug 2523856 (CVE-2026-78961)

Summary: CVE-2026-78961 chromium-browser: Google Chrome: Web origin policy bypass via crafted HTML page and social engineering
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Google Chrome's core functionality. A remote attacker, who has already compromised a part of the browser responsible for rendering web content (the renderer process) and used social engineering tactics, could bypass the security mechanism that isolates content from different websites (the web origin policy). This could allow the attacker to access or manipulate information from other websites that the user is visiting, potentially leading to unauthorized data access or actions.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2524890, 2524891    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-25 20:45:03 UTC 
Incorrect authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)