Google Chrome CVE-2026-78968

Exploitation requires that the attacker has already achieved compromise of the Chrome renderer process through a separate, prior vulnerability - this is not a standalone initial-access vector. The crafted HTML page is the delivery mechanism for the second-stage spoof, but it only functions after renderer compromise is established. User interaction is required in the form of visiting a page (UI:R per CVSS). The flaw affects all desktop platforms. Limiting factors: renderer process compromise is a significant prerequisite that substantially raises the effective attack complexity beyond what the AC:L CVSS metric suggests; no authentication is required at the browser level once renderer access is obtained, but achieving renderer access itself typically requires exploiting a separate critical-severity browser vulnerability.

The provided CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) overstates ease of exploitation by omitting the critical prerequisite: the attacker must have already achieved renderer process compromise before this flaw is exploitable. This is a second-stage vulnerability that elevates an existing renderer compromise into address bar spoofing capability - a meaningful security boundary bypass, but not a standalone initial-access vector. EPSS at 0.28% (20th percentile) aligns with this chained requirement. There is no KEV listing and no reported POC. The SSVC technical impact is partial (integrity only, no code execution, no data exfiltration). Real-world priority is moderate: organizations running Chrome at scale should patch with their normal update cadence, but this does not warrant emergency response absent evidence of active renderer exploits being chained with this flaw.

An attacker who has separately exploited a renderer-process vulnerability (e.g., a V8 or Blink memory corruption bug) then serves a crafted HTML page that abuses the missing authorization check to rewrite the address bar, displaying a trusted origin (such as a banking domain) while the user is actually on attacker-controlled content. This enables high-confidence phishing or credential harvesting against users who rely on the address bar as a trust signal. No public POC for this specific flaw has been identified.