Google Chrome CVE-2026-76038

The sole prerequisite is that the victim visits an attacker-controlled or compromised web page using an unpatched Chrome version (prior to 151.0.7922.169) on any desktop platform. No authentication, no account, no special browser configuration, and no installed extension is required - the attack surface is the default V8 JavaScript engine present in every Chrome installation. Limiting factors: user interaction is required (UI:R), the victim must actively navigate to or load the malicious page; exploitation is not automatable against passive targets. Successful exploitation achieves code execution only within the Chrome renderer sandbox (S:U/no scope change), not the host OS, absent an additional sandbox escape. No platform-specific or non-default configuration is required.

CVSS 8.8 correctly captures the theoretical severity - network-reachable, low complexity, no authentication, user-interaction-only gate - but several signals pull the practical priority downward. EPSS is 0.39% at the 33rd percentile, which is low for an 8.8-scored browser RCE and suggests the vulnerability has not yet attracted widespread exploitation tooling. SSVC confirms exploitation=none and automatable=no, consistent with UI:R requiring active user navigation to a malicious page, which prevents mass automated scanning attacks. The sandbox constraint (S:U) is the critical architectural mitigating factor: even successful exploitation yields renderer-level code execution, not host OS access. No CISA KEV listing and no public POC are confirmed in the available data. The net picture is a genuine high-severity finding warranting prompt patching - Chrome's auto-update mechanism makes remediation tractable at scale - but not an emergency requiring immediate network-level controls given the absence of confirmed exploitation.

An attacker hosts a webpage containing crafted JavaScript that triggers the V8 type confusion bug; a victim running an unpatched Chrome version visits the page, causing Chrome to mishandle an internal object type and allowing the attacker to execute arbitrary code within the Chrome renderer process. From that foothold, a chained sandbox escape exploit would be needed to reach the underlying operating system. No public proof-of-concept is confirmed in the available data.