Google Chrome CVE-2026-78944

Exploitation requires the victim to be actively socially engineered into installing a crafted Chrome extension - this is not a passive, zero-click drive-by vulnerability. The CVSS UI:R and the description's explicit 'leveraging social engineering' language confirm that user participation is a hard prerequisite. The vulnerability resides in the DevTools component, indicating DevTools must be accessible or invoked (either by the user or programmatically by the extension) during the exploit trigger. SSVC's 'not automatable' determination confirms mass-scanning exploitation is not feasible. Limiting factors include: (1) the social engineering step required to deliver the extension, (2) Chrome's renderer sandbox which contains arbitrary code execution and prevents direct OS access without a chained escape, and (3) SSVC exploitation status of 'none' indicating no current active threat actor tooling. The CVSS PR:N confirms no account credentials on the target machine are required from the attacker.

The CVSS 8.8 score reflects the full C:H/I:H/A:H triad, but the UI:R (user interaction required) component is critical context: this is not a passive or autonomous exploit. The attacker must socially engineer the victim into installing a malicious extension, which represents a meaningful operational barrier. SSVC independently confirms that the attack is not automatable and that exploitation is currently at the 'none' tier, reinforcing that this is not being actively weaponized at scale. The S:U (scope unchanged) metric and the description's explicit 'inside the sandbox' language consistently indicate that code execution is sandboxed - system-level compromise would require a separate, chained sandbox escape. No EPSS data was provided, so probabilistic exploitation likelihood cannot be quantified from available input. On balance, this is a high-severity vulnerability warranting prompt patching in all enterprise Chrome deployments, but the social engineering dependency and sandbox containment place it below the urgency tier of unauthenticated, pre-auth remote code execution flaws.

An attacker packages a use-after-free trigger into a Chrome extension and distributes it via a spear-phishing campaign - for example, posing as a required corporate productivity tool or a browser update helper. Once the victim installs the extension and it interacts with the DevTools component, the freed memory region is reclaimed with attacker-controlled data, redirecting execution to shellcode that runs within Chrome's renderer sandbox. A full system compromise would additionally require chaining a sandbox escape; no public proof-of-concept code for either stage has been identified in the provided data.