Google Chrome CVE-2026-78974

Exploitation requires the target to be running Google Chrome on Linux with the Linux Toolkit Theming component active - this is the default configuration for all Linux Chrome installations and requires no special setup by the victim. The attack requires social engineering: the victim must be persuaded to navigate to a crafted HTML page, making user interaction (UI:R per CVSS) a hard prerequisite the attacker cannot bypass. The attack vector is network-based (AV:N) with low complexity (AC:L) and no privilege requirement (PR:N). Exploitation is constrained by the following limiting factors: the social engineering dependency (attacker cannot force page navigation), the Linux-only platform scope (Chrome on Windows and macOS is unaffected), and the modest resulting impact ceiling (low confidentiality and integrity impact, no availability impact per CVSS S:U/C:L/I:L/A:N). No non-default configuration setting or feature flag is required - any unpatched Linux Chrome user visiting the crafted page is potentially exploitable.

The CVSS 3.1 base score of 5.4 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N correctly reflects a network-reachable flaw that demands active user participation, substantially limiting its real-world severity relative to fully unauthenticated, non-interactive exploits. An EPSS of 0.30% at the 23rd percentile corroborates that opportunistic mass exploitation is not anticipated; the social engineering prerequisite raises the practical attack cost considerably compared to direct code-execution vulnerabilities. No active exploitation is confirmed - the CVE is not in CISA KEV and no proof-of-concept code has been identified - placing this firmly in the 'patch in routine cycle' category for most organizations. SSVC assessment: exploitation status is unreported, the attack is not automatable due to the required social engineering step, and technical impact is partial. The effective population at risk is further narrowed to Chrome users specifically on Linux desktops, excluding Windows and macOS deployments. Despite modest urgency, the UI-spoofing pattern is precisely the mechanism used in targeted phishing campaigns against Linux power users and developers, so Linux-heavy environments should verify patch deployment rather than defer indefinitely. The 'Authentication Bypass' tag applied to this entry is imprecise; no technical authentication mechanism is bypassed - the restriction bypass is user-mediated through deceptive UI rendering, which is a meaningfully different threat model.

An attacker hosts a crafted HTML page that exploits the Linux Toolkit Theming rendering flaw to display a misleading UI element - such as a spoofed system permission dialog or falsified security indicator - that mimics a trusted prompt in the Chrome interface on Linux. The attacker directs a target Linux Chrome user to the page via a phishing email or malicious link, and the user, deceived by the misrepresented UI, interacts with the dialog in a way that bypasses intended system access restrictions. No public exploit code has been identified at time of analysis, and the social engineering dependency means exploitation cannot be fully automated.