What is the CVSS score of CVE-2026-79021?

CVE-2026-79021 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-79021?

Yes, a patch is available for CVE-2026-79021. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-79021

EUVD-2026-66077 MEDIUM

Missing Authorization (CWE-862)

2026-08-25 Chrome

GHSA-rgph-qwq5-gggr

Google Authentication Bypass

6.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

5.3 MEDIUM

AC:H reflects the mandatory renderer-process compromise prerequisite, which materially increases exploitation complexity beyond the NVD-assigned AC:L.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 27, 2026 - 18:30 vuln.today

CVSS changed

Aug 27, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Aug 25, 2026 - 20:10 cve.org

MEDIUM 6.5

CVE Published

Aug 25, 2026 - 20:10 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Missing authorization in InterestGroups in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted PDF file. (Chromium security severity: Low)

AnalysisAI

Missing authorization in Chrome's InterestGroups API allows a renderer-compromised attacker to bypass system access restrictions via a crafted PDF file. Affected are all Google Chrome versions prior to 152.0.7977.65 across desktop platforms. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Establish renderer-process code execution

Delivery

Craft malicious PDF exploiting InterestGroups flaw

Exploit

Deliver PDF to victim via phishing or malicious site

Install

Victim opens PDF in Chrome

Trigger missing authorization check in InterestGroups API

Execute

Bypass system access restrictions

Impact

Achieve high-integrity unauthorized write/modification

Recon

Establish renderer-process code execution

Delivery

Craft malicious PDF exploiting InterestGroups flaw

Exploit

Deliver PDF to victim via phishing or malicious site

Install

Victim opens PDF in Chrome

Trigger missing authorization check in InterestGroups API

Execute

Bypass system access restrictions

Impact

Achieve high-integrity unauthorized write/modification

Vulnerability AssessmentAI

Exploitation	Exploitation requires two conditions to be met simultaneously: (1) the renderer process must already be compromised via a separate, preceding vulnerability - this CVE does not standalone enable renderer compromise; and (2) the victim must interact with a crafted PDF file (UI:R confirmed by CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) overstates real-world risk by assigning AC:L and PR:N, but the description explicitly requires a prior renderer-process compromise - a significant precondition that in practice represents a separate vulnerability in a multi-stage chain. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker first exploits a separate renderer-process vulnerability to gain code execution within Chrome's sandboxed renderer. They then deliver or redirect the victim to a crafted PDF file - triggering Chrome's internal PDF renderer - which exercises the missing authorization path in the InterestGroups API, allowing the attacker to bypass system access restrictions and achieve high integrity impact beyond the renderer sandbox. …
Remediation	Update Google Chrome to version 152.0.7977.65 or later via the built-in update mechanism (Help > About Google Chrome) or enterprise deployment tooling. … Detailed patch versions, workarounds, and compensating controls in full report.