Google Chrome CVE-2026-76033

Exploitation requires two distinct preconditions: first, the attacker must have already compromised the Chrome renderer process through a separate vulnerability prior to leveraging this flaw - this is an explicit prerequisite stated in the CVE description and encoded in AC:H of the CVSS vector; second, the victim user must interact with or navigate to a crafted HTML page (UI:R). The CORS bypass itself operates at the network/browser policy layer and does not require any special Chrome configuration or non-default settings - once the renderer is compromised, the flaw is reachable in a standard Chrome deployment. Exploitation is limited by: the high complexity of first achieving renderer compromise, the need for active user interaction with the crafted page, and the partial (C:L/I:L) rather than total cross-origin data access implied by the low impact ratings. No authentication credentials to any service are required by the attacker.

The CVSS base score of 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) reflects the genuine constraints on exploitability: AC:H encodes the substantial prerequisite of a prior renderer compromise, and UI:R requires the victim to interact with a crafted page. No EPSS score was provided in the source data; however, the chained nature of the exploit (requiring a separate renderer-compromise vulnerability to first be triggered) significantly limits real-world exploitation probability despite the network attack vector. Neither CISA KEV status nor public exploit code is present in available intelligence. The scope metric S:U in the provided vector deserves scrutiny: bypassing site isolation conceptually crosses security boundaries between origins, which aligns more closely with S:C - yet the C:L/I:L impact ratings suggest only partial data exposure rather than full cross-origin takeover. This tension may indicate the CORS bypass is constrained to narrow information leakage rather than broad isolation defeat. The 'Authentication Bypass' tag from source data is somewhat misleading - this is a site isolation bypass, not an authentication system bypass. Overall, real-world priority is moderate: the renderer-compromise prerequisite substantially raises the exploitation bar, making this a meaningful defense-in-depth failure rather than a critical standalone vector.

An attacker who has already exploited a separate renderer-compromise vulnerability in Chrome - for example, a JavaScript engine memory-corruption bug - uses that foothold within the renderer process to serve or navigate to a crafted HTML page that triggers the flawed CORS handling. The CORS logic fails to enforce the site isolation boundary, allowing the attacker's renderer context to read or write data belonging to a different, isolated origin such as a banking or intranet site open in another tab. No public exploit code for this specific CORS flaw has been identified, so this scenario presupposes chaining with an unrelated renderer vulnerability.