Google Chrome CVE-2026-78896

Exploitation has one hard prerequisite: the victim must actively visit an attacker-controlled crafted HTML page in an unpatched Chrome browser (prior to 152.0.7977.65). The CVSS PR:N vector confirms no attacker-side authentication is required - the attacker merely hosts the malicious page. Exploitation is limited by: mandatory active user interaction (the victim must navigate to the page, not just receive a passive network packet); unchanged scope (S:U in CVSS confirms no sandbox escape or privilege escalation beyond the browser renderer); and partial confidentiality impact only with no integrity or availability consequence (I:N/A:N). The SSVC automatable: no classification independently confirms that mass automated exploitation without per-victim user interaction is not feasible. Non-default browser configurations or policies that restrict Storage Access API usage would further reduce exposure.

The CVSS 4.3 score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a network-reachable vulnerability with no authentication requirement but mandatory user interaction, limited to partial confidentiality impact with no integrity or availability consequence. EPSS of 0.24% at the 15th percentile is very low, and SSVC independently corroborates this with exploitation: none and automatable: no - the user-interaction gate (UI:R) prevents mass automated scanning and exploitation. KEV is absent, no POC is known, and the Chromium team itself rated this Low severity. Even a well-resourced threat actor would find more efficient cross-origin data theft vectors than this flaw. The primary real-world risk is targeted abuse against specific high-value users via phishing links, not opportunistic mass exploitation. There is no conflict between data sources - all signals consistently indicate low urgency.

An attacker hosts a crafted HTML page that abuses Chrome's StorageAccessAPI to read cross-origin data from a victim's active browser session. The victim is lured to the page via a phishing link or malicious advertisement; once the page loads, it silently reads restricted cross-origin storage data. No public exploit code exists at time of analysis, so crafting a working exploit requires meaningful knowledge of Chrome's StorageAccessAPI internals and cross-origin boundary enforcement.