Google Chrome CVE-2026-79006

Exploitation requires a victim running Google Chrome prior to 152.0.7977.65 and active user interaction with web content (UI:R per CVSS vector), meaning the victim must be actively browsing rather than passively connected. The CVSS AV:N vector indicates network exploitability without requiring physical proximity; however, the nature of the HttpsUpgrades bypass suggests the attacker benefits from the ability to influence network traffic between the victim and remote servers, such as a man-in-the-middle position or a malicious server serving crafted responses. No attacker authentication or elevated privileges are required (PR:N). Impact is strictly limited to partial confidentiality disclosure (C:L) - no data modification or service disruption is achievable through this vulnerability. Exploitation is further constrained to Chrome desktop versions; mobile Chrome and other Chromium-based browsers are not confirmed affected by this specific advisory.

The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N accurately reflects a moderate-severity finding: network-reachable, low complexity, no privileges required, but constrained by mandatory user interaction and limited to partial confidentiality impact with no integrity or availability consequences. The EPSS score of 0.26% at the 18th percentile is consistent with this assessment and suggests the vulnerability has not attracted significant exploit development interest. The 'Authentication Bypass' tag in the intelligence metadata is somewhat misleading - this is a web origin policy bypass, not a traditional authentication bypass, and the CVSS PR:N metric reflects lack of required attacker privileges rather than a bypass of user authentication. No KEV listing and no public exploit code further reinforce that operational risk is currently low. The missing detail is whether the HttpsUpgrades feature is enabled by default in all Chrome configurations or only in specific deployment modes; if it can be disabled by enterprise policy, managed environments may have reduced exposure.

An attacker positioned to inject or manipulate network traffic - for example via a rogue Wi-Fi access point or a compromised network path - serves crafted HTTP responses designed to trigger a failure in Chrome's HttpsUpgrades mechanism. When a victim user on an unpatched Chrome instance browses normally and their traffic passes through this attacker-influenced network segment, the origin policy bypass takes effect, allowing the attacker to read a limited portion of cross-origin response content. No public exploit code for this specific issue has been identified at time of analysis.