Google Chrome CVE-2026-76043

The victim must actively visit an attacker-controlled or attacker-compromised HTML page using a Chrome version prior to 151.0.7922.169 - this is the sole prerequisite for exploitation, consistent with UI:R in the CVSS vector. No authentication to any service is required (PR:N). JavaScript must be enabled, which is the default Chrome configuration; disabling JavaScript would prevent exploitation. Exploitation is confined to the Chrome renderer sandbox; achieving full host OS access would require an additional, separate sandbox escape vulnerability not described in this CVE. The attack is not limited to a specific OS platform; Chrome's V8 engine operates equivalently across Windows, macOS, and Linux.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the attack profile: network-reachable, low complexity, no privileges required, minimal friction for the attacker, with full confidentiality, integrity, and availability impact within the browser process. The UI:R requirement means the victim must actively visit a malicious or attacker-controlled web page, which is a realistic and common attack delivery mechanism. S:U (scope unchanged) confirms that this is sandbox-contained RCE - a full host OS compromise would require a chained sandbox escape, which is not described in the available data. No EPSS score is provided in the input data, so exploitation probability cannot be quantified. No CISA KEV listing and no POC code are identified at time of analysis, which lowers immediate tactical urgency but does not diminish the structural risk given Chrome's ubiquitous deployment. The combination of AV:N/AC:L/PR:N means exploitation is trivially automatable once a working exploit exists.

An attacker hosts a malicious web page containing carefully crafted JavaScript designed to trigger the V8 incorrect calculation flaw. A victim using an unpatched Chrome browser is directed to the page via a phishing link, malvertising redirect, or compromised legitimate site. Upon the page loading and V8 processing the crafted script, the attacker achieves arbitrary code execution within Chrome's renderer process, potentially enabling theft of session cookies, stored credentials, and browsing data accessible within that process.