Google Chrome CVE-2026-78940

Exploitation requires a user to navigate to a crafted HTML page using Google Chrome prior to version 152.0.7977.65 - user interaction (UI:R) is a hard prerequisite confirmed by the CVSS vector, meaning passive drive-by exploitation without navigation is not possible. The CVSS metrics PR:N and AV:N confirm the attacker requires no authentication and no special network position; any internet-accessible malicious page suffices. Exploitation is bounded by: (1) mandatory user navigation to the attacker's page, (2) limited confidentiality impact only (C:L - partial origin-policy bypass, not full cross-origin read), and (3) no integrity or availability impact. No special browser configuration, extension, or feature flag is identified as a prerequisite or as an additional limiter beyond the version constraint.

The CVSS 4.3 Medium rating reflects a real but bounded risk: AV:N/AC:L/PR:N/UI:R captures a remotely triggerable flaw requiring no attacker privilege and only low complexity, but mandating user interaction. EPSS at 0.36% (29th percentile) corroborates a low current exploitation probability, consistent with the absence of a KEV listing and no reported POC. The limited scope (S:U) and impact ceiling (C:L only) mean this vulnerability cannot serve as a standalone compromise vector - it is a data disclosure primitive, not a code execution path. No conflict between CVSS signals and description is apparent: the network vector is consistent with a browser-delivered exploit requiring page navigation. Overall, this is a genuine security deficiency warranting prompt patching but not emergency incident response; standard browser auto-update cadence is an appropriate remediation posture for most environments.

An attacker registers a domain and serves a crafted HTML page designed to trigger Chrome's improperly initialized network state. When a user on a vulnerable Chrome version navigates to the page, the browser's origin validation logic fails, allowing the attacker's script to read limited data from a cross-origin context it should not have access to. No public POC is currently available, and successful exploitation requires the victim to actively visit the attacker's page.