Google Chrome CVE-2026-78959

Exploitation requires the victim to be running Google Chrome prior to version 152.0.7977.65 on an operating system with a case-insensitive or case-preserving filesystem (most commonly Windows NTFS or macOS HFS+/APFS), as the bypass relies on the mismatch between Chrome's case-sensitive access checks and the underlying filesystem's case-insensitive path resolution. The attacker must successfully socially engineer the victim into visiting a crafted HTML page (UI:R), which is the primary limiting factor against mass or automated exploitation. No authentication or special privileges are required from the attacker (PR:N). The attack is further bounded by the availability of the FileSystem API in the browser context and the specific file or directory targeted needing to have a meaningful access restriction in place.

The CVSS 6.5 Medium score is internally consistent with its vector: low attack complexity and no required privileges lower the bar for attackers, but mandatory user interaction (UI:R) from social engineering breaks automated exploitation paths. The EPSS of 0.33% at the 26th percentile is aligned with a medium-severity, no-POC vulnerability - suggesting low but non-negligible probability of exploitation in the near term. No CISA KEV listing appears in the provided data, and no public proof-of-concept code is referenced, so exploitation remains unconfirmed rather than confirmed absent. The 'Authentication Bypass' tag aligns with the high integrity impact (I:H), indicating the bypass can yield meaningful unauthorized access. Despite the low EPSS, Chrome's ubiquitous deployment footprint means even a targeted, low-frequency exploit could affect a large absolute number of users. The patch is vendor-confirmed and available, making remediation straightforward and the residual risk low post-patch.

An attacker hosts a crafted HTML page that invokes Chrome's FileSystem API with a path constructed using unexpected case combinations - for example, using uppercase variants of a restricted directory name on a case-insensitive Windows NTFS volume. The attacker sends a phishing link to a target running Chrome below 152.0.7977.65; when the victim opens the page, the browser's access restriction check fails to recognize the mixed-case path as restricted and grants file access. No public proof-of-concept has been identified at time of analysis, but the low attack complexity (AC:L) suggests the bypass is straightforward once the case collision is identified.