Google Chrome CVE-2026-79001

Exploitation requires two simultaneous preconditions: (1) the attacker must have already compromised the Chrome renderer process via a separate, independent vulnerability - this is not a standalone exploit; and (2) the attacker must successfully social engineer the victim into interacting with a crafted HTML page (UI:R). Both conditions must be met concurrently. The vulnerability is further constrained to macOS only - Chrome on Windows or Linux is not affected. Limiting factors: the renderer compromise prerequisite makes this a chained exploit scenario not suitable for mass exploitation; SSVC confirms it is not automatable. A victim running an up-to-date Chrome without any other active browser vulnerability has no viable attack surface here.

Real-world risk is low despite the C:H CVSS confidentiality rating. The CVSS vector (AV:N/AC:H/PR:N/UI:R) honestly captures the two hard prerequisites: a pre-existing renderer compromise (AC:H) and active social engineering (UI:R). These chained requirements make this an exploitation second-stage primitive rather than a standalone attack. EPSS at 0.29% (21st percentile) corroborates low exploitation probability, and SSVC confirms Automatable:no and Technical Impact:partial. There is no CISA KEV listing and no public exploit code. The 'Low' Chromium severity classification is consistent with these signals. The primary risk scenario is an advanced threat actor using this as part of a multi-stage browser attack chain targeting macOS users, not broad opportunistic exploitation. The limitation to macOS further constrains the attack surface.

An attacker who has already exploited a separate Chrome renderer vulnerability on a macOS target crafts a malicious HTML page designed to invoke Bluetooth APIs from the compromised renderer context. They then use social engineering - such as a deceptive prompt or redirect - to induce the victim to interact with the page, triggering the information leak and exposing Bluetooth device information back to the attacker. No public exploit code exists for this vulnerability at time of analysis.