Google Chrome CVE-2026-78935

Exploitation requires the victim to actively open attacker-controlled content: the CVE specifies a 'crafted HTML page' processed by Chrome's Mobile component on iOS, and the CVSS vector's UI:R confirms required user interaction. No authentication is needed (PR:N) and it works remotely over the network (AV:N) at low complexity (AC:L) against Chrome for iOS versions before 152.0.7977.65. Limiting factors: the target must be running a vulnerable Chrome build on iOS (not Safari or another browser), the user must be induced to load the malicious page, and - per SSVC - exploitation is not automatable, arguing against mass, hands-off campaigns.

Signals conflict between severity and imminence. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) and CISA SSVC 'Technical Impact: total' both reflect a genuine sandbox-escape RCE, but SSVC also marks Exploitation 'none' and Automatable 'no', and EPSS is only 0.41% (34th percentile) with no KEV listing and no known POC - meaning severe potential impact but no evidence of active or automatable exploitation today. The one true mitigating factor is UI:R: exploitation requires the victim to open attacker-controlled content, so this is not a wormable, zero-click issue. Overall this is a patch-promptly-but-not-emergency item: high theoretical impact, currently low real-world exploitation pressure. Treat the low EPSS as a snapshot that can rise quickly once details or exploits surface for a Critical browser bug.

An attacker hosts or injects a crafted HTML page and lures an iOS Chrome user (via phishing link, malvertising, or a compromised site) to open it. Rendering the page triggers the uninitialized-variable condition, and the attacker chains it to break out of the browser sandbox and run code on the device. No public POC or active exploitation is known at time of analysis, and success depends on the victim navigating to the malicious content (UI:R).