Google Chrome CVE-2026-78906

The victim must actively visit an attacker-controlled or compromised web page using Chrome prior to version 152.0.7977.65 - passive exploitation without navigation is not possible (UI:R). Hardware-accelerated graphics rendering must be active, which is the default configuration on virtually all Chrome installations and is the primary ANGLE attack surface. No attacker-side authentication or local access to the victim system is required (PR:N). Key limiting factors are: (1) the victim must use an unpatched Chrome build below 152.0.7977.65; (2) the race condition must be won, requiring repeated attempts or environmental tuning to achieve reliable exploitation; and (3) the CVSS S:U notation is inconsistent with the description's claim of sandbox escape - if S:U is accurate, impact is contained within Chrome's process boundary, substantially reducing post-exploitation reach.

The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U) encodes meaningful real-world constraints: high attack complexity due to race condition timing requirements substantially reduces reliable exploitation, and mandatory user interaction eliminates passive drive-by scenarios. EPSS at 0.28% (20th percentile) is consistent with the SSVC determination of no active exploitation, suggesting the vulnerability has not been weaponized at scale. However, SSVC independently rates technical impact as total, meaning a successful exploit yields full host-level compromise - a significant consequence if the complexity barrier is overcome. A material inconsistency warrants attention: the CVE description explicitly states code execution occurs 'outside the sandbox,' which in CVSS 3.1 terminology implies a scope change (S:C), yet the provided vector carries S:U (unchanged scope). Security teams should treat this as unresolved and verify against the Chromium issue tracker. Given AC:H, low EPSS, and no public exploit, this fits the profile of a patch-on-normal-cycle priority rather than emergency response, but the sandbox escape claim elevates it above routine browser bugs.

An attacker hosts a crafted HTML page incorporating WebGL or JavaScript content designed to trigger concurrent access to a shared ANGLE resource at precise timing intervals. When a victim navigates to the page in a vulnerable Chrome version, the race condition is triggered - potentially requiring multiple page interactions or controlled timing - until memory corruption yields a code execution primitive that breaks out of Chrome's sandbox. No public proof-of-concept has been confirmed at time of analysis; AC:H reflects the probabilistic, timing-dependent nature of winning the race.