Google Chrome CVE-2026-76024

Exploitation requires the victim to open attacker-controlled content: a crafted HTML page that exercises the MediaStream component in Chrome versions prior to 156.0.8078.79. Per the CVSS vector, no authentication is needed (PR:N) but user interaction is required (UI:R) - the victim must load the malicious page, which is the primary limiting factor. The impact is bounded to reading memory inside the renderer sandbox (C:H, I:N, A:N); the description does not claim a sandbox escape or code execution. The flaw affects default Chrome installations, so no special configuration is required beyond running an unpatched version.

The signals converge on a moderate, non-emergency priority. The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - network-reachable and unauthenticated, but requiring user interaction, and with impact confined to confidentiality (C:H) with no integrity or availability effect. This is consistent with the description, which states the flaw allows an attacker to 'potentially read memory inside the sandbox' - i.e. an information-disclosure read primitive, not code execution or sandbox escape. Note the apparent tension worth flagging: Chromium labels this 'Critical' severity in its own internal rating, while the provided CVSS base score is only 6.5 (Medium); Chromium's label reflects the memory-corruption class rather than demonstrated impact, so the gap is expected rather than contradictory, but teams keying off the word 'Critical' should understand the measured impact is a sandboxed read. Exploitation signals are low: EPSS is 0.18% (7th percentile), SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, and there is no CISA KEV listing. The vuln.today decision label is 'this_month,' which matches a patch-promptly-but-not-emergency posture. Overall this is a real but mid-tier issue - patch within the normal browser-update cycle; it is not a drop-everything event, and there is no evidence of active exploitation or automation.

An attacker hosts or injects a crafted HTML page that drives the MediaStream component and lures a victim running a vulnerable Chrome build to open it (UI:R - user interaction required). The resulting memory corruption lets the attacker read memory contents from within the renderer sandbox, potentially disclosing sensitive in-process data. No public exploit code is identified in the provided data, and the specific trigger mechanics are not described in the available sources.