Google Chrome CVE-2026-78954

Exploitation requires that the attacker has already achieved code execution within the Chrome renderer process - either via a separate, concurrently exploited renderer vulnerability or through another pre-existing compromise mechanism. The victim must also interact with a crafted HTML page (UI:R), consistent with the CVSS vector. The actual SOP bypass then requires the attacker to trigger the specific incorrect authorization check in the Extensions API from within the compromised renderer context. Limiting factors: the renderer-compromise prerequisite is a high bar that effectively makes this a chained exploit; Chrome's sandbox architecture means renderer compromise alone does not escape the sandbox or gain OS-level privileges; the base confidentiality impact is Low (C:L), and no integrity or availability impact is reflected in the NVD data. No special extension needs to be installed by the victim for the flaw to be exploitable.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N = 4.3) materially understates the attack complexity: the description explicitly requires a pre-compromised Chrome renderer process, which contradicts AC:L and PR:N. This discrepancy should be verified against the Chromium issue tracker entry (issues.chromium.org/issues/540870921, currently restricted). In practice this is a second-stage or chained exploit - the renderer compromise is itself a non-trivial prerequisite, making autonomous mass exploitation unlikely. EPSS at 0.34% (26th percentile) reflects this low realistic exploitability; no CISA KEV entry exists. The 'High' Chromium internal severity likely reflects the strategic value of a SOP bypass (cross-origin data theft) rather than ease of exploitation. Teams should prioritize the patch upgrade as a standard browser hygiene measure but need not treat this as an emergency requiring immediate emergency out-of-band response - the chained nature of the attack significantly limits opportunistic exploitation.

An attacker first exploits a separate renderer-process vulnerability in a victim's Chrome browser (via a malicious or compromised website), gaining code execution within the sandboxed renderer. From that position, they serve a crafted HTML page that invokes the flawed Extensions authorization path, bypassing the same-origin policy and reading sensitive cross-origin resources - such as authenticated session data or page content from a banking or intranet origin open in another tab. No public proof-of-concept for this specific CVE has been identified at time of analysis.