Google Chrome CVE-2026-76041

Exploitation requires the victim to actively visit or be redirected to a crafted HTML page - the CVSS UI:R metric confirms this mandatory passive user interaction. The attack is network-delivered (AV:N) with no authentication required (PR:N) and low complexity (AC:L), making phishing or malicious-ad delivery viable. Exploitation is bounded by the unchanged scope (S:U): impact remains within the Chrome browser process and does not directly compromise the underlying operating system. No special browser configuration, extension, or non-default feature is required - the vulnerable Skia rendering path is exercised by default on any page load. The limiting factors for defenders are the user-interaction requirement (auto-visit or direct navigation needed) and the low confidentiality impact ceiling (C:L), which constrains what data can realistically be extracted.

The CVSS 4.3 Medium score reflects a real but constrained risk: network-reachable, low-complexity, no-privilege attack limited by mandatory user interaction (UI:R) and low confidentiality impact (C:L). Despite the moderate numeric score, the nature of the flaw - a Same-Origin Policy bypass via the graphics layer - carries practical significance beyond raw CVSS, since cross-origin leaks can expose authentication tokens, session data, or sensitive page content depending on the victim's browsing context. EPSS data was not provided in the intelligence set, preventing quantitative exploitation probability assessment. The vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. No public exploit code was identified in the provided data. The overall priority is moderate: Chrome's ubiquitous deployment creates a large attack surface, but the user-interaction requirement and limited impact scope constrain immediate risk.

An attacker crafts a malicious HTML page that triggers the Skia rendering information leak, then delivers it via phishing, malicious advertising, or a compromised website. When the victim visits the page, the rendering pipeline discloses cross-origin information - potentially exposing data from other tabs or resources loaded in the browser session - which the attacker's JavaScript can then read and exfiltrate. No public exploit code was identified in the provided data, so exploitation currently requires independent vulnerability research to reproduce.