Google Chrome CVE-2026-79013

Exploitation requires Chrome Sync to be enabled and actively communicating with Google's Sync backend - the default state for any Chrome user signed into a Google account. The CVSS AC:H rating indicates the attacker must satisfy an additional precondition beyond simple network reachability: most plausibly, network-level interception or injection capability between the victim and Google Sync endpoints (man-in-the-middle positioning). Exploitation is therefore limited by: (1) the need for active Sync usage by the victim, (2) network-level positioning to intercept or craft Sync traffic (not achievable from the open internet without additional access), and (3) an unspecified protocol state or timing requirement reflected in the AC:H metric. Exploitation does not require any user interaction or attacker authentication, but the AC:H constraint significantly limits opportunistic, automated exploitation scenarios.

CVSS 5.9 (Medium) is calibrated by the AC:H constraint against an otherwise permissive attack profile (AV:N, PR:N, UI:N). The C:H impact is significant - Chrome Sync stores highly sensitive data including saved credentials - but AC:H materially reduces opportunistic exploitation risk. EPSS 0.34% at the 27th percentile is consistent with AC:H: this is not a mass-exploitation candidate. No CISA KEV listing and no known POC further confirm low current exploitation activity. The primary real-world risk is targeted attacks against high-value individuals (journalists, executives, activists) where an attacker can achieve man-in-the-middle positioning. For enterprise environments managing Chrome via policy, the risk is concentrated among users who have Google Sync enabled - a common default for consumer installs but often disabled by enterprise policy. The CVSS vector and description are internally consistent; no conflicting signals detected.

An attacker with man-in-the-middle positioning on a network traversed by a victim's Chrome Sync traffic - such as a rogue Wi-Fi access point or a compromised network segment - crafts malformed Sync protocol messages that bypass input validation. The Chrome client processes the adversarial payload, and improperly validated data paths expose sensitive synchronized content such as saved passwords or session tokens back to the attacker. No public proof-of-concept exists at time of analysis, so the precise protocol state required to trigger disclosure is not publicly known.