Google Chrome CVE-2026-78946

Exploitation requires a user to actively navigate to an attacker-controlled HTML page using a vulnerable Chrome version (below 152.0.7977.65) - the CVSS UI:R metric confirms passive drive-by exploitation without user navigation is not applicable. No authentication is required from the attacker's perspective (PR:N), and no special server-side configuration is needed; the attack is delivered entirely via a crafted HTML page. Impact is constrained to integrity only (I:L) with no confidentiality or availability effect, and scope is contained to the vulnerable Chrome instance (S:U), meaning the attacker cannot pivot to other system components. The primary limiting factors are the mandatory user interaction and the narrow, integrity-only impact ceiling.

The CVSS 4.3 score reflects a network-reachable, low-complexity attack requiring no privileges but mandatory user interaction (UI:R), scoped to the vulnerable system with integrity-only impact (I:L, C:N, A:N). These signals collectively indicate a real but bounded risk: the attacker cannot passively exploit; a user must navigate to the crafted page. EPSS at 0.26% (18th percentile) is notably low and aligns with Chromium's own Low severity designation, suggesting the vulnerability class is not attractive to automated exploitation pipelines. There is no CISA KEV listing and no known public exploit, further reducing urgency. The integrity-only, non-scoped impact means even a successful exploit does not expose credentials or crash the browser - it produces limited unauthorized cross-origin actions. While the ubiquitous deployment of Chrome means the total exposed population is enormous in absolute terms, the combination of required user interaction, low EPSS, no KEV, and minimal impact ceiling keeps this firmly in the patch-on-cycle rather than emergency-response tier.

An attacker hosts a crafted HTML page that exploits the incorrect authorization in Chrome's Select component to bypass same-origin policy restrictions. When a victim using a vulnerable Chrome version navigates to the page - via a phishing link, malvertising redirect, or compromised site - the attacker's script performs limited unauthorized cross-origin integrity actions within the user's browsing session. No public exploit code has been identified at time of analysis, making opportunistic mass exploitation unlikely in the near term.