Google Chrome CVE-2026-78937

Exploitation requires the victim to actively open or navigate to an attacker-controlled crafted HTML page in Chrome for Android (UI:R in the CVSS vector), and the description explicitly names social engineering as the delivery prerequisite - there is no drive-by/zero-click path indicated. The vulnerable code path is the Search component in Chrome on Android specifically, on builds prior to 152.0.7977.65, so patched clients and non-Android Chrome may not be affected in the same way. Limiting factors that reduce real-world risk: mandatory user interaction, the need for a working UAF-to-sandbox-escape exploit chain (SSVC Automatable=no, reflecting non-trivial exploitation), no authentication is required (PR:N) but the attacker cannot compromise a target that never opens the malicious content.

Signals are notably mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) reflects a network-reachable, unauthenticated, low-complexity bug with a sandbox-escape scope change - severe on paper. However, the actual exploitation signals argue for a more moderate real-world priority: SSVC records Exploitation=none and Automatable=no (user interaction and social engineering defeat mass automation), EPSS is only 0.33% at the 25th percentile, the bug is not in CISA KEV, and no POC is indicated. Google's own Chromium rating is Medium, not Critical, which conflicts with the 9.6 base score - the discrepancy stems from CVSS mechanically maximizing the scope-change/impact metrics while Google factors in exploit difficulty (a reliable UAF-to-sandbox-escape chain requiring victim interaction is hard to weaponize). Note also that the referenced Chrome release blog post is titled 'Stable Channel Update for Desktop' while the CVE description scopes the bug to Android - verify the exact affected surface with the vendor advisory. Net: patch on the normal browser-update cadence; this is a high-severity bug but current data (SSVC=none, low EPSS, no KEV/POC) points to it not being under active or imminent mass exploitation.

An attacker crafts a malicious web page containing JavaScript that manipulates the browser heap to trigger the use-after-free in Chrome's Search component, then socially engineers a target - for example via a phishing message or malicious ad - into opening the page on their Android device. If the exploit is reliable, the freed-object reuse is escalated into arbitrary code execution outside the renderer sandbox. No public POC is identified at time of analysis, and successful exploitation depends on the victim's interaction.