Google Chrome CVE-2026-78898

Exploitation requires the target to be running Google Chrome prior to version 152.0.7977.65 on a desktop platform and to actively interact with a crafted HTML page via a social engineering lure that induces a download action. The CVSS vector confirms that no attacker authentication is required (PR:N) but that user interaction is mandatory (UI:R), preventing fully automated or passive drive-by exploitation. Exploitation is further limited by: (1) the social engineering dependency, which requires user decision to click or confirm a download; (2) an unchanged scope (S:U), meaning the attacker cannot pivot beyond Chrome's existing OS process boundary; and (3) impacts capped at low confidentiality and low integrity with no availability effect, ruling out full system compromise. There is no indication in the description or references that a non-default Chrome configuration is required.

The CVSS 5.4 Medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) reflects a network-accessible, unauthenticated flaw constrained by mandatory user interaction and limited-magnitude impacts. The EPSS score of 0.32% (24th percentile) aligns with the absence of public exploit code and KEV listing, indicating that automated or widespread exploitation is unlikely in the near term. Social engineering as the required delivery mechanism prevents fully drive-by exploitation - the attacker must craft a convincing HTML lure and induce a download interaction, raising the bar above simple passive browsing. Scope is unchanged (S:U), meaning a successful attacker cannot pivot beyond Chrome's existing OS-level process context. The impacts are bounded to low confidentiality and low integrity effects with no availability impact, ruling out system takeover scenarios. No conflict between CVSS vector and description is detected. Overall this fits a routine patch-cycle priority: organizations should apply Chrome 152.0.7977.65 within a normal patching window rather than treating it as an emergency response.

An attacker crafts a malicious HTML page designed to trigger Chrome's incorrect authorization check during a download operation, then distributes it via phishing email or malicious advertisement. A user on an unpatched Chrome version visits the page and is socially engineered - through a convincing prompt or disguised download button - into initiating a download action. Chrome's authorization logic then incorrectly permits a file read or write to an OS-restricted location, giving the attacker limited access to files or directories outside the normally permitted scope.