Google Chrome CVE-2026-79010

Exploitation requires that the attacker has already achieved code execution within the Chrome renderer process via a separate, independent vulnerability - this prerequisite is explicitly stated in the CVE description ('a remote attacker who had compromised the renderer process'). Beyond renderer compromise, the victim must visit a crafted HTML page (UI:R per CVSS), so user interaction is required. The use-after-free in the Network component then allows the pre-compromised renderer to bypass same-origin policy enforcement. Key limiting factors: the vulnerability cannot be exploited without prior renderer compromise, restricting the realistic threat actor population to sophisticated parties capable of chaining multiple browser vulnerabilities; and the user must actively visit a malicious or attacker-influenced page. Default Chrome configurations with strict site isolation partially contain post-compromise lateral movement but do not prevent the SOP bypass itself once the renderer is controlled.

The reported CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) encodes the outer attack surface but does not capture the mandatory prerequisite of prior renderer process compromise, which substantially raises effective attack complexity beyond what AC:L implies. In practice this vulnerability is a second-stage component of a multi-exploit browser chain, not an autonomously weaponizable flaw. EPSS at 0.66% (49th percentile) aligns with that characterization - exploitation probability is low and inconsistent with automated or opportunistic scanning. The absence from CISA KEV and the lack of any public POC further support treating this as a targeted-actor threat rather than a broad internet-scale risk. The origin-bypass capability is meaningful post-renderer-compromise - it can enable cross-origin session token or API response exfiltration - but the limiting prerequisite means organizations should prioritize patching as a routine update rather than an emergency response unless they have evidence of active targeted campaigns.

An attacker who has already exploited a separate renderer-process remote code execution vulnerability delivers a crafted HTML page to the victim's compromised Chrome renderer. The page triggers the use-after-free condition in Chrome's Network component, causing same-origin policy enforcement to malfunction and allowing the attacker's renderer code to read cross-origin HTTP responses - for example, authenticated API replies or session cookies from a co-loaded web application. No public exploit code for CVE-2026-79010 specifically has been identified at time of analysis.