Google Chrome CVE-2026-76020

Exploitation requires the victim to be running Google Chrome prior to version 151.0.7922.173 and to actively navigate to or be redirected to an attacker-controlled HTML page - passive exploitation without user browser interaction is not possible, as confirmed by the UI:R CVSS metric. The AC:H metric indicates that the attacker must win a precise timing race in V8's concurrent execution environment, which is non-trivial and limits reliable exploitation to technically sophisticated actors. No authentication to any service is required (PR:N), and no special Chrome configuration or non-default feature flag is necessary - any default-configured Chrome installation on a vulnerable version is susceptible upon user interaction. Impact is bounded by the Chrome sandbox (S:U); full system compromise requires an independent sandbox-escape primitive not present in this CVE. There are no platform or OS restrictions indicated in the available data.

The CVSS 3.1 score of 7.5 (High) accurately captures the network-reachable, unauthenticated attack surface while the AC:H metric reflects the genuine difficulty of reliably triggering a race window in a multi-threaded JIT engine - this is not a push-button exploit. The S:U (unchanged scope) bounds impact within Chrome's renderer sandbox, meaning full system compromise requires a separate sandbox-escape primitive. The EPSS score of 0.28% at the 20th percentile is low, which is consistent with high-complexity browser race conditions: they are prized by advanced threat actors but rarely commodity-exploited. There is no CISA KEV listing and no POC code in the available intelligence, so active widespread exploitation is not confirmed. Despite the complexity hurdle, the ubiquitous deployment of Chrome means that even a mid-sized enterprise IT team should treat this as an urgent patch - the attack surface is every employee's browser, and targeted exploitation by a capable actor is plausible given the RCE potential. No conflicting signal exists between CVSS and description; both indicate network-delivered, user-interaction-dependent exploitation.

An attacker crafts a malicious HTML page containing JavaScript engineered to race two concurrent V8 execution paths against each other, collapsing the TOCTOU window to corrupt heap state in the renderer process. When a targeted user opens the page in an unpatched Chrome browser, the race fires and yields arbitrary code execution within the renderer sandbox, potentially enabling data exfiltration from the browser process or serving as the first stage of a two-step exploit chain if paired with a sandbox escape. No public exploit code has been identified, so successful exploitation currently requires significant V8 internals expertise.