Google CVE-2026-5879

The victim must open a crafted HTML page in Google Chrome on Mac versions prior to 147.0.7727.55. Remote unauthenticated attacker requires user interaction (victim visits malicious webpage). Code executes within Chrome's sandbox.

Despite the high 8.8 CVSS score driven by complete CIA impact, real-world risk is moderate. The CVSS vector reveals network-based attack (AV:N) with low complexity (AC:L) requiring no privileges (PR:N) but mandatory user interaction (UI:R), meaning victims must visit or be socially engineered to attacker-controlled pages. EPSS probability of 0.05% (16th percentile) indicates security researchers and threat actors have not prioritized this vulnerability for exploitation development. No confirmed active exploitation exists per CISA KEV absence, and no public exploit identified at time of analysis further reduces immediate threat. The sandbox containment (S:U - unchanged scope) significantly constrains post-exploitation impact compared to true sandbox escapes. However, the medium Chromium security severity rating, combined with Chrome's massive macOS user base and the requirement for only user interaction (not privileged actions), maintains residual risk. Organizations should prioritize patching Chrome installations but need not treat this as a critical emergency given low exploitation signals and sandbox constraints. The SSVC framework would likely classify this as requiring scheduled patching rather than emergency deployment, given no exploitation evidence and technical impact limited to sandbox context.

An attacker hosts a malicious website containing specially crafted HTML with embedded graphics operations targeting ANGLE's input validation weakness. When a macOS Chrome user visits the page through phishing, malvertising, or watering hole attacks, the malformed graphics instructions bypass ANGLE's validation routines and trigger arbitrary code execution within Chrome's sandbox. The attacker gains code execution capabilities constrained to the sandbox context, enabling exfiltration of browser data including cookies, session tokens, stored passwords, and browsing history, or performing actions as the authenticated user across all open web sessions.