Google Chrome CVE-2026-78895

The victim must be running Google Chrome prior to 152.0.7977.65 and must actively visit (or be redirected to) the attacker-crafted HTML page - exploitation cannot occur without this user interaction (UI:R). The attack is network-delivered and requires no authentication from the attacker side (PR:N). No special non-default browser configuration is required. Exploitation is limited by the user-interaction requirement, which prevents fully automated drive-by exploitation without some form of social engineering or ad network delivery. The information exposed is described as partial (C:L), limiting the value of any single successful exploitation.

The CVSS 3.1 base score of 4.3 (Medium) is consistent with the limited impact profile: AV:N indicates network reachability, AC:L means no special conditions, PR:N confirms no attacker authentication is needed, but UI:R requires the victim to visit a crafted page, and C:L reflects only partial confidentiality exposure with no integrity or availability impact. EPSS at 0.33% (25th percentile) suggests this is unlikely to be mass-exploited imminently. There is no CISA KEV listing and no POC is known, making this a lower operational priority than its network vector might imply. That said, Chrome's ubiquitous deployment means even low-probability exploitation at scale represents non-trivial aggregate risk, particularly for high-value targets where cross-origin data theft from a single page visit could be meaningful. The UI:R requirement limits opportunistic mass exploitation but does not protect against targeted phishing-driven delivery.

An attacker hosts a crafted HTML page that triggers a rendering sequence through Chrome's Paint component causing cross-origin content or pixel data to leak into an attacker-accessible context. The victim is directed to this page via a phishing link or malicious advertisement; upon rendering, the Paint subsystem exposes information from an isolated origin, potentially including rendered content from a concurrently open authenticated session. No public proof-of-concept code is known at time of analysis.