Google Chrome CVE-2026-78942

Exploitation requires the target to be running Google Chrome prior to version 152.0.7977.65 on any supported platform. User interaction is mandatory per the CVSS UI:R metric - the victim must navigate to or otherwise interact with attacker-crafted content; fully passive or drive-by exploitation without any browser action is not possible under this model. No special Chrome configuration or non-default settings are required; the flaw exists in the default Loader behavior. Exploitation is additionally constrained by the need to deliver crafted network traffic correlated with the victim's browsing session, which may require a network-adjacent position or a hosted malicious page. The absence of integrity and availability impact limits attacker leverage to cross-origin data reading rather than code execution or session takeover directly.

The CVSS 4.3 Medium score reflects a meaningful but constrained threat profile: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R) and no integrity or availability impact (I:N/A:N). The EPSS of 0.30% at the 22nd percentile places this well below the threshold of actively targeted vulnerabilities, and the absence of a CISA KEV listing or public exploit code further supports treating this as a standard patch-cycle priority rather than an emergency. The user interaction requirement is the primary limiting factor - fully passive or automated mass exploitation is not viable under the CVSS model. While Chrome's ubiquitous deployment means even a modest exploitation rate would affect large numbers of users, the constrained impact (limited confidentiality, no integrity or availability) caps the blast radius per victim. Overall, this is a real but low-urgency issue appropriately addressed through Chrome's normal auto-update mechanism.

An attacker crafts a malicious web page or intercepts network traffic to deliver specially structured responses that trigger Chrome's Loader into misresolving a resource's origin. When a victim user navigates to the attacker's page in an unpatched Chrome browser, the incorrect reference resolution causes the browser to treat the attacker-controlled resource as belonging to a trusted origin, bypassing the Same-Origin Policy and potentially allowing the attacker's script to read responses or data from a co-browsed trusted site. No public exploit code has been identified at the time of this analysis.