CVE-2026-78967

View on CVE.org
Published Aug 25, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Missing authorization in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

Missing authorization in the Back‑Forward Cache allows a remote attacker who has already compromised the renderer process to execute a crafted HTML page that bypasses system access restrictions. The flaw removes the expected authorization checks, enabling the attacker to elevate privileges and access protected resources within the user’s environment.

Affected Systems

Google Chrome browsers prior to version 152.0.7977.65. Any user running an affected Chrome build is susceptible until an update is applied.

Risk and Exploitability

The CVSS score of 6.5 indicates a medium severity. Exploitation requires initial compromise of the renderer process, so it is not trivially exploitable from a remote standpoint. The EPSS score is less than 1% and the flaw is not listed in the CISA KEV catalog, indicating the overall risk is moderate pending update.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 152.0.7977.65 or later
  • Enable automatic Chrome updates on all client systems to ensure timely patching
  • Consider disabling or limiting BFCache usage via Chrome policies if immediate upgrade is not possible

Generated by OpenCVE AI on August 28, 2026 at 22:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Title Chrome BFCache Authorization Bypass Enables System Access Overreach
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}
Type Values Removed Values Added
Title Chrome BFCache Authorization Bypass Enables System Access Overreach
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Missing authorization in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-862
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Sep 17, 2026, 6:50 PM
Reserved
Aug 25, 2026, 6:05 AM

View source JSON

Updated
Aug 28, 2026, 6:16 PM

JSON

Status
Analyzed
Published
Aug 25, 2026, 9:17 PM
Modified
Aug 31, 2026, 1:40 PM

View source JSON

No data.

Updated
Aug 28, 2026, 11:00 PM

JSON