Google Chrome CVE-2026-79015

Exploitation requires the victim to be running Google Chrome prior to 152.0.7977.65 and to visit a crafted HTML page controlled by the attacker (UI:R per CVSS). ServiceWorker is enabled by default in all modern Chrome versions - no special configuration is needed to expose this code path. The CVSS PR:N metric confirms no attacker authentication is required. Impact is bounded to integrity (I:L) with no confidentiality or availability compromise (C:N/A:N), and the scope is unchanged (S:U), meaning the attacker cannot pivot to affect systems outside the vulnerable browser process. Exploitation is further limited by the requirement for active user interaction, the absence of known public exploit code, and the 'Low' internal Chromium severity rating suggesting the bypassed restriction has constrained practical value to attackers.

The CVSS base score of 4.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N) attack that requires user interaction (UI:R) and yields only integrity impact (I:L) with no confidentiality or availability loss (C:N/A:N). EPSS at 0.30% (23rd percentile) indicates low probability of observed exploitation, consistent with the absence of a CISA KEV listing and no known public exploit code. The internal Chromium severity classification of 'Low' further corroborates limited real-world impact. The combination of required user interaction, scope-unchanged impact, and integrity-only outcome places this firmly in a patch-on-next-cycle rather than emergency-response tier for most organizations. No conflicting signals are present in the available data, though the specific restriction that can be bypassed is not disclosed in public references.

An attacker registers a malicious website and crafts an HTML page that exploits the ServiceWorker input validation flaw to bypass a system access restriction. The victim is directed to the page via a phishing link or malvertising redirect, triggering the ServiceWorker to process the malicious input upon page load. This results in a limited integrity violation within the browser's security model, such as unauthorized write access to a restricted resource, without gaining code execution or leaking sensitive data.