Google Chrome CVE-2026-78904

Exploitation requires the victim to load a crafted HTML/WebGL page in an unpatched Chrome build (prior to 152.0.7977.65), so user interaction (UI:R) - navigating to or opening the malicious page - is the key prerequisite; there is no authentication requirement (PR:N). Limiting factors: the victim must actually visit attacker-controlled content, the graphics/ANGLE path must be reachable (hardware acceleration/WebGL enabled, which is the default), and reliable exploitation of a type confusion into a full sandbox escape is non-trivial, consistent with CISA SSVC rating the attack as not automatable. Environments that disable WebGL/hardware acceleration meaningfully reduce exposure.

The signals are partially divergent and should be weighed together rather than in isolation. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) is severe: network-reachable, low complexity, no privileges, only user interaction required (visiting a page), and a scope change that reflects the described sandbox escape. Against that, the EPSS score is low (0.38%, 31st percentile), the CVE is NOT on CISA KEV, and CISA SSVC records Exploitation: none and Automatable: no - meaning no evidence of active exploitation and no reliable mass-automation path today, though Technical Impact is rated total. This is a genuine high priority because of the near-universal deployment of Chrome and the sandbox-escape potential, but it is not (yet) a confirmed emergency: the low EPSS and 'Exploitation: none' suggest no widespread weaponization at this time. Given Chrome's ubiquity, any organization - from a large enterprise to a mid-sized municipal IT team - should still patch promptly under normal browser-update cadence rather than deferring. Note one caveat to verify: the description says the flaw 'potentially' executes code 'outside the sandbox,' which is a strong claim for a type confusion in ANGLE; treat the sandbox-escape characterization as vendor-described rather than independently confirmed.

An attacker hosts or compromises a web page containing crafted WebGL/graphics content that triggers the ANGLE type confusion, then lures a victim (phishing link, malvertising, or watering-hole) into loading it in a vulnerable Chrome build. When rendered, the corrupted memory operation is leveraged to execute attacker-controlled code, potentially escaping the renderer sandbox as described. No public proof-of-concept has been identified at time of analysis.