{"id":"CVE-2026-79006","title":"chromium-browser: Google Chrome: Web origin policy bypass via crafted network traffic (CVE-2026-79006)","summary":"A flaw was found in Google Chrome. This vulnerability, located in the HttpsUpgrades component, allows a remote attacker to bypass the web origin policy. By sending specially crafted network traffic, an attacker could circumvent security re…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvssSource":"adp","cwe":["CWE-693"],"vendor":"Red Hat","product":"Chrome","affected":["Chrome >= 152.0.7977.65 < 152.0.7977.65"],"published":"2026-08-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T07:40:42+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79006.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79006.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-79006"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79006"},{"url":"https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html"},{"url":"https://issues.chromium.org/issues/502344135"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00246,"epssPercentile":0.15839,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-27T19:28:54.482708Z"},"ingestedAt":"2026-09-17T23:31:20.812Z","slug":"CVE-2026-79006","body":"## Overview\n\nA flaw was found in Google Chrome. This vulnerability, located in the HttpsUpgrades component, allows a remote attacker to bypass the web origin policy. By sending specially crafted network traffic, an attacker could circumvent security restrictions designed to isolate content from different websites, potentially leading to unauthorized access or manipulation of data.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79006.json)\n\n**chromium-browser: Google Chrome: Web origin policy bypass via crafted network traffic**. Released 2026-08-25, updated 2026-09-25.\n\nNot affected:\n\n- All currently supported Red Hat products\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}