Google Chrome CVE-2026-78999

Exploitation requires two concurrent prerequisites: (1) the attacker must have already achieved code execution within the Chrome renderer process - meaning a separate renderer-level vulnerability must first be exploited - and (2) the victim must be socially engineered into a specific interaction with a crafted HTML page (UI:R). These are significant limiting factors: the renderer compromise prerequisite means this is a second-stage exploit in a chained attack, not a standalone remote code execution path. Exploitation is limited to desktop Chrome versions prior to 152.0.7977.65 on platforms where Chrome is installed. The social engineering requirement (UI:R) additionally means fully automated exploitation without any user action is not possible. No non-default configuration setting is required - any user running an unpatched Chrome version who visits a malicious page could be targeted if a renderer compromise is available to the attacker.

The CVSS 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) captures both the severity of impact and the non-trivial prerequisites. AC:H correctly reflects that exploitation requires a pre-compromised renderer process - itself requiring a separate, unrelated vulnerability - and UI:R reflects the social engineering component. The scope change (S:C) with C:H/I:H/A:H reflects the extreme consequence of a successful sandbox escape. Against the raw CVSS score, the EPSS score of 0.40% at the 33rd percentile signals low real-world exploitation probability, consistent with the two-stage attack complexity. No KEV listing and no public POC further reduce near-term exploitation risk. The realistic prioritization: organizations running Chrome at enterprise scale should treat this as a standard patch-urgency update rather than an emergency response, unless they have reason to believe targeted exploitation is occurring. The primary driver for patching is the ubiquitous deployment footprint of Chrome, not imminent mass exploitation.

An attacker first exploits a separate renderer-level vulnerability in Chrome to gain code execution within the sandboxed renderer process, then serves a crafted HTML page that triggers the Navigation privilege mismanagement flaw while using social engineering to induce the required user interaction (such as a deceptive prompt or redirect). Once the Navigation flaw is triggered with the compromised renderer, the attacker escapes the Chrome sandbox and achieves arbitrary code execution at the OS privilege level of the Chrome process. No public proof-of-concept code has been identified, meaning this scenario currently requires significant attacker capability.