Google Chrome CVE-2026-78934

Exploitation requires the target user to visit a crafted HTML page, meaning successful social engineering (phishing, malvertising, or drive-by via a compromised trusted site) is a hard prerequisite - reflected in CVSS UI:R. The ReadAloud feature must be available in the browser (it is enabled by default in recent Chrome versions). The race condition introduces an AC:H constraint: the attacker must reliably win a timing window that is sensitive to system load, thread scheduling, and browser state, making exploitation inherently non-deterministic and difficult to automate at scale (SSVC Automatable: no). Exploitation is limited to Chrome versions prior to 152.0.7977.65; updated browsers are not affected. No authentication is required (PR:N), and the attack is network-delivered, but the user interaction and timing requirements together represent meaningful exploitation barriers beyond raw CVSS score.

CVSS 8.3 reflects a serious but practically constrained threat: AV:N confirms internet-reachable delivery, but AC:H acknowledges that race condition exploitation requires precise timing and is difficult to trigger reliably. UI:R and the 'social engineering' prerequisite further reduce opportunistic attack surface. EPSS at 0.33% (26th percentile) is low for a score in the 8.x range, consistent with the SSVC 'Exploitation: none' and 'Automatable: no' assessments - no mass-exploitation tooling is known. SSVC rates Technical Impact as 'total,' which aligns with the S:C, C:H/I:H/A:H CVSS metrics: a successful exploit grants full post-sandbox capabilities. The combination of 'total' technical impact and 'not automatable' means this is a high-value, targeted-attack-class vulnerability rather than a spray-and-pray worm vector - even a mid-sized IT operation should prioritize patching given Chrome's ubiquity, though immediate emergency response is tempered by the lack of observed exploitation. No KEV listing and no public POC have been identified, which is consistent with the difficulty of reliably weaponizing a race condition.

An attacker hosts a crafted HTML page that, when rendered by Chrome's ReadAloud component, triggers a race condition between two concurrent execution paths sharing unsynchronized state. The attacker distributes the link via phishing or malvertising to lure a target into visiting the page, after which the race condition is won to corrupt or redirect execution flow, achieving arbitrary code execution within the Chrome renderer sandbox - and potentially escaping it given the S:C metric.