Google Chrome CVE-2026-78991

Exploitation requires two compounding conditions: first, the attacker must have already achieved compromise of the Chrome renderer process (a significant prerequisite typically requiring a separate, distinct browser vulnerability); second, the victim user must navigate to or be served a crafted HTML page. The renderer compromise prerequisite is the dominant limiting factor - it places this vulnerability firmly in multi-stage, targeted attack territory rather than accessible to unsophisticated attackers. The race condition's AC:H rating further constrains reliable exploitation, as the attacker must win a narrow timing window. No special browser configuration or non-default settings are required beyond these conditions. Exploitation is limited to the confidentiality impact category (C:H); there is no integrity or availability component, so data exfiltration is the realistic end-state, not code execution through this specific CVE alone.

Real-world risk is moderate-to-low despite the High confidentiality impact in CVSS. The official CVSS 3.1 score of 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) captures several limiting factors: high attack complexity due to the race condition timing window, required user interaction, and critically, the implicit prerequisite that the renderer process must already be compromised. This prerequisite - not reflected as PR in CVSS but material to real-world risk - effectively makes this a second-stage vulnerability requiring a separate renderer compromise exploit to chain with. EPSS at 0.29% (22nd percentile) corroborates low exploitation likelihood. The vulnerability is not listed in CISA KEV, no POC code has been identified, and the patch has already been shipped. For organizations running patched Chrome deployments, risk is negligible. For those lagging on updates, this becomes relevant only in the context of a broader multi-stage attack. No conflicting signals between CVSS and description are observed - the data is internally consistent.

An attacker operating within an already-compromised Chrome renderer process - achieved via a separate vulnerability - serves or manipulates a crafted HTML page to trigger a race condition in the WebProtect subsystem, winning the timing window to read sensitive memory or data protected by WebProtect before the security check resolves. No public exploit code for this specific race condition has been identified, and the high attack complexity means reliable exploitation requires precise timing, making opportunistic mass exploitation unlikely.