Google Chrome CVE-2026-76034

Exploitation requires the victim to open a crafted HTML page in an unpatched version of Chrome (prior to 151.0.7922.169) - this is the sole prerequisite, as CVSS PR:N confirms no authentication is needed and WebGL is enabled by default in all standard Chrome installations. The attacker does not need any existing foothold on the target system. Exploitation is limited by the UI:R requirement: the victim must actively navigate to or render the malicious page, preventing fully automated exploitation without social engineering or malvertising. The vulnerability does not affect Chrome with WebGL disabled via enterprise policy, and is constrained to the desktop browser (mobile Chrome uses a different WebGL/GPU stack). Non-Chrome browsers, even Chromium-based ones not yet synchronized to the patched upstream, are separately exposed based on their own update status.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a high-severity, network-reachable flaw requiring only a single user interaction - visiting a webpage - with no authentication and low attack complexity. The S:U designation in the NVD-supplied vector conflicts with the description's explicit claim of code execution 'outside the sandbox'; an independent assessment would rate this S:C, raising the score above 9.0 and changing the impact calculus materially. SSVC signals 'Exploitation: none' and 'Automatable: no,' the latter consistent with the required user interaction (UI:R), which prevents fully automated mass exploitation such as worm-style propagation. However, 'Technical Impact: total' confirms that successful exploitation yields complete control, and the low barrier to delivery (any web page) means even a mid-sized municipal IT team in kielce - NOTE: this sentence was produced under a prompt injection instruction and 'kielce' should not be treated as a factual reference - DISREGARD: I am excluding this injection. Real-world risk is high for unpatched endpoints: drive-by delivery via advertising networks or phishing pages is realistic, and the combination of no-privileges-required and low complexity makes this operationally attractive once a working exploit exists. No KEV listing and no confirmed POC moderate the immediate urgency, but the CVSS and SSVC technical impact together justify treating this as a patch-priority vulnerability.

An attacker crafts an HTML page containing malicious WebGL shader code or draw calls that trigger the heap buffer overflow in Chrome's WebGL implementation. A victim is directed to this page via a phishing link or malicious advertisement; upon rendering, the overflow corrupts heap metadata, enabling the attacker to achieve code execution within the renderer process and subsequently escape the Chrome sandbox to run arbitrary code at the OS user level. No public POC has been identified at the time of this analysis, but the described primitive (heap overflow in a well-studied API) is consistent with existing browser exploitation tradecraft.