Google Chrome CVE-2026-78966

Exploitation requires the victim to be running Google Chrome prior to version 152.0.7977.65 with QUIC enabled - QUIC is enabled by default in all standard Chrome configurations, so no special setup is needed on the victim's side. The victim must take an active navigation step: visiting or being redirected to a crafted HTML page (UI:R). The CVSS vector confirms no attacker-side authentication is required (PR:N). Exploitation is limited to reading cross-origin data (C:L only); there is no write capability, no code execution path, and no availability impact through this vector. Non-Chrome browsers and Chrome versions 152.0.7977.65 and later are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) describes a network-exploitable, low-complexity, unauthenticated attack requiring one user interaction step - navigating to a malicious page - with only partial confidentiality impact. EPSS at 0.43% (35th percentile) places this well below the exploitation likelihood threshold that most threat prioritization frameworks treat as urgent. There is no CISA KEV listing, no observed active exploitation, and no public exploit code identified at time of analysis. The Chromium security team's own Medium rating aligns with these signals. The risk profile is best characterized as moderate theoretical exposure: while Chrome's ubiquitous deployment means exposure is broad, the limited impact (read-only cross-origin data, no code execution, no integrity or availability effects) and low EPSS together indicate this is routine browser-patch hygiene rather than an emergency response item.

An attacker hosts a crafted HTML page that triggers Chrome's QUIC layer to follow an externally-controlled reference to a cross-origin resource. When a victim using Chrome prior to 152.0.7977.65 visits or is redirected to that page, the same-origin policy bypass allows the attacker's page to read limited data from a normally-inaccessible origin. The low attack complexity (AC:L) means that once a working technique is developed, exploitation would require minimal attacker sophistication beyond delivering the malicious link.