CVE-2026-79133

The vulnerability is an incorrect authorization check in the handling of form data within Google Chrome. A remote attacker can create a crafted HTML page that, when opened in a vulnerable browser instance, allows the attacker to read sensitive information entered into web forms. The weakness means that the browser does not verify that a web page is allowed to access form data, leading directly to data exposure. The primary impact is confidentiality loss through unauthorized access to personal or organizational data that users enter into web forms.

All installations of Google Chrome before version 152.0.7977.65 are affected, regardless of operating system. Users who have not updated the browser from these builds are vulnerable to the flaw.

The vulnerability is classified as medium severity with a CVSS score of 6.5, and the EPSS score is < 1%. It is not listed in CISA's KEV catalog. The likely attack vector is a remote attacker crafting a malicious HTML page; the user must visit or have the page displayed in the browser for exploitation. Because the flaw allows surface-level access to form data, there is a moderate potential for sensitive data exposure, but the limited severity rating suggests that current exploitation activity is low.