Google Chrome CVE-2026-78975

The attacker must induce the target user to visit a crafted HTML page using a vulnerable Chrome version (prior to 152.0.7977.65) - user interaction is mandatory (UI:R per CVSS). No authentication or special privileges are required on the attacker's side (PR:N). Exploitation is limited strictly to confidentiality impact; no code execution, data modification, or denial of service is possible through this flaw. The flaw is specific to Chrome's DOM implementation and does not affect other browsers. The social-engineering prerequisite (user must actively navigate to the malicious page) represents the primary limiting factor for realistic exploitation, preventing automated or drive-by mass targeting without an initial delivery vector.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5, reflecting low attack complexity and no required privileges but mandatory user interaction - the victim must visit a crafted page. Confidentiality impact is High while Integrity and Availability are unaffected, classifying this as a pure information-disclosure flaw. EPSS at 0.36% (28th percentile) is notably low for a Chrome-class vulnerability, and the CVE is absent from CISA KEV, with no public exploit identified. The required UI:R gating limits automated mass exploitation and aligns with the low EPSS signal. Real-world priority is moderate: the High confidentiality impact warrants patching, but the social-engineering prerequisite and absence of any exploitation evidence makes this lower urgency than Chrome flaws with active KEV listings.

A threat actor hosts a crafted HTML page containing JavaScript that triggers the DOM authorization bypass to read sensitive cross-origin or privileged DOM properties. The victim is lured via phishing or malvertising to navigate to the page in a vulnerable Chrome version; upon render, the script silently exfiltrates accessible data without requiring any further user action beyond the initial page visit. No public proof-of-concept has been identified, but the low attack complexity (AC:L) suggests exploitation would be straightforward once the specific vulnerable DOM access path is identified by a researcher.