Google Chrome CVE-2026-78983

Exploitation requires two sequential conditions to both be satisfied: first, the attacker must have already achieved code execution within Chrome's renderer process (via a separate, unchained vulnerability); second, the victim must interact with a crafted HTML page that triggers the Views use-after-free. The CVSS UI:R reflects that victim browser interaction is required. Exploitation is not automatable (confirmed by SSVC) due to the renderer pre-compromise prerequisite. What limits exploitation: the renderer compromise prerequisite substantially raises the attack chain complexity; AC:H confirms this. Attackers without the means to chain a renderer RCE cannot use this CVE as a standalone entry point.

The CVSS base score of 8.3 with S:C/C:H/I:H/A:H reflects the severity of the impact - full compromise of the browser process - but AC:H accurately captures the significant prerequisite: prior renderer compromise. In practice this is a two-vulnerability chain, materially raising the real-world exploitation bar beyond what a standalone 8.3 would suggest. EPSS at 0.52% (42nd percentile) is low, consistent with the complexity requirement. SSVC exploitation is rated 'none' with automatable 'no,' aligning with these signals. This CVE is not listed in CISA KEV. The combination of EPSS, SSVC, and chained exploitation requirement firmly places this in a 'monitor and patch promptly but not emergency' category for most organizations - the exception being high-value targets where sophisticated threat actors with multi-stage browser exploit chains are plausible.

A sophisticated attacker first exploits a separate renderer-level vulnerability (e.g., a JavaScript engine bug) when the victim visits a malicious HTML page, gaining code execution inside Chrome's sandboxed renderer process. The attacker then triggers the Views use-after-free from within the compromised renderer, escalating to execute arbitrary code at the browser process privilege level outside the sandbox, achieving full host-level code execution. No public exploit code for this specific CVE has been identified at time of analysis.