Google Chrome CVE-2026-78989

Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build (before 152.0.7977.65) on Windows - user interaction is mandatory (UI:R), so the attacker must lure the user to a crafted page rather than trigger it silently. The flaw is in the Windows ANGLE-to-Direct3D graphics path, making it platform-specific to Windows; non-Windows Chrome is not indicated as affected. No authentication or prior privileges are needed (PR:N). Limiting factors: required user interaction, dependence on the browser exercising the vulnerable graphics code (WebGL/GPU rendering), and the technical difficulty of turning an out-of-bounds read into a reliable sandbox escape and code execution.

Signals conflict in an instructive way. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) is severe because it combines network reach, low complexity, no privileges, and a scope change reflecting sandbox escape - only user interaction (visiting a page) is required. Against that, EPSS is only 0.42% (35th percentile), there is no CISA KEV listing, and no public exploit is identified, indicating that despite the high CVSS this is not currently under active or widespread exploitation. Browser bugs of this class are high-value but typically require chaining and reliable heap grooming, so weaponization is non-trivial. Net: a genuine high-priority patch item for any Windows Chrome fleet given ubiquity and sandbox-escape potential, but not an emergency 'exploited-now' scenario based on the available data.

An attacker hosts or injects a malicious HTML page containing crafted WebGL/graphics content that triggers the out-of-bounds read in ANGLE when rendered. A victim running vulnerable Chrome on Windows visits the page (e.g., via phishing link or malvertising), and the attacker leverages the resulting memory disclosure and corruption to attempt code execution outside the renderer sandbox. No public exploit is identified at time of analysis, so this remains a plausible but unproven chain.