Google Chrome CVE-2026-78893

The victim must actively navigate to an attacker-controlled HTML page using an unpatched Chrome instance (prior to 152.0.7977.65). Chrome must negotiate a QUIC connection during page load, which occurs by default when connecting to QUIC-capable servers - no special non-default configuration is required on the victim's side. From the attacker's perspective, no authentication or prior access to the victim system is required (PR:N). Exploitation is limited by the mandatory user interaction (UI:R): the victim must visit the crafted page, preventing fully automated mass exploitation. The confidentiality impact is high but scope is unchanged (S:U), meaning the leak is confined to the Chrome renderer process context rather than enabling OS-level data access. Unpatched Chrome on any supported platform is susceptible; Chrome version 152.0.7977.65 and later are not affected.

The CVSS 6.5 score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a meaningful confidentiality risk: network-reachable, low complexity, no attacker privileges required, but user interaction is mandatory, which limits automatable mass exploitation. This is corroborated by SSVC classifying Automatable as 'no' - the UI:R gate prevents reliable mass deployment of exploit payloads. EPSS at 0.31% (23rd percentile) aligns with SSVC's exploitation status of 'none', suggesting no active threat actor activity at time of analysis. The high confidentiality impact metric is notable and may reflect cross-origin data leakage scenarios with real data exposure potential, but the absence of KEV listing and low EPSS together indicate this is not currently being prioritized by threat actors. Real-world priority is moderate: ubiquitous product footprint warrants patching, but urgency is lower than KEV-listed Chrome vulnerabilities. No conflicting signals identified between CVSS, EPSS, and SSVC assessments.

An attacker sets up a malicious website that serves a crafted HTML page designed to trigger Chrome's QUIC stack in a way that leaks sensitive information - potentially cross-origin data or session-related content - back to the attacker's server. The victim is lured to the page via phishing, malvertising, or a compromised third-party site, and upon loading the page in an unpatched Chrome instance, the QUIC protocol processes the crafted content and the information disclosure occurs transparently. No public exploit code exists at time of analysis, and the attack requires active user navigation to the malicious page.