Google Chrome CVE-2026-78900

Exploitation requires the victim to load attacker-controlled content: a crafted HTML page processed by Chrome's Media subsystem (UI:R - user interaction, i.e. visiting/rendering the page, is mandatory). No authentication or prior privileges are needed (PR:N) and the attack is network-delivered with low complexity (AV:N/AC:L). The key limiting factor is that exploitation is not automatable per SSVC and cannot occur without user interaction - the target must open or be redirected to the malicious page in a vulnerable Chrome build (any version before 152.0.7977.65); it does not fire passively without navigation, and it does not require any non-default browser configuration.

The signals here are mixed but lean toward high priority for a browser. CVSS 9.6 with AV:N/AC:L/PR:N/UI:R/S:C reflects a low-complexity, unauthenticated, network-reachable sandbox escape requiring only that a user visit a page - a realistic condition for a browser. Countervailing signals temper urgency: EPSS is low at 0.35% (28th percentile), CISA SSVC records Exploitation as 'none' and Automatable as 'no', it is absent from CISA KEV, and no proof-of-concept is referenced, so there is no evidence of active or automated exploitation yet. However, SSVC Technical Impact is 'total,' matching the C:H/I:H/A:H full-compromise rating, and sandbox escapes in Chrome's Media stack are historically attractive to attackers once details or patches are reverse-engineered. The low EPSS should be read as 'not yet widely exploited,' not 'low consequence' - because Chrome is deployed almost everywhere, any operator should treat a patched sandbox-escape RCE as urgent and roll it out promptly rather than waiting for exploitation to appear. Bottom line: a real priority driven by ubiquity and total impact, even though current exploitation evidence is absent.

An attacker hosts or compromises a web page containing crafted media content and lures a victim into visiting it (via phishing link, malvertising, or a watering-hole site). When Chrome's Media component processes the malicious content, the improper input validation is triggered and the attacker executes arbitrary code outside the renderer sandbox on the victim's machine. No proof-of-concept is currently referenced, and the AV:N/AC:L/UI:R vector means the only meaningful barrier is getting the user to open the page.