Google Chrome CVE-2026-79021

Exploitation requires two conditions to be met simultaneously: (1) the renderer process must already be compromised via a separate, preceding vulnerability - this CVE does not standalone enable renderer compromise; and (2) the victim must interact with a crafted PDF file (UI:R confirmed by CVSS vector). The InterestGroups feature is part of Chrome's Privacy Sandbox and is enabled by default in standard Chrome builds, so no non-default configuration toggle is needed once the renderer is compromised. Limiting factors include: mandatory prior renderer-level code execution, user interaction with a malicious PDF, and Chrome version prior to 152.0.7977.65. Exploitation is not viable against patched instances or where PDF rendering is handled by an external application rather than Chrome's built-in viewer.

The NVD-assigned CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) overstates real-world risk by assigning AC:L and PR:N, but the description explicitly requires a prior renderer-process compromise - a significant precondition that in practice represents a separate vulnerability in a multi-stage chain. This precondition should elevate AC to High, bringing the realistic exploitability considerably lower. Chromium's own security severity rating of Low corroborates this reassessment. EPSS at 0.23% (13th percentile) is consistent with a chained, low-footprint exploitation scenario. No KEV listing and no known POC further reduce urgency. The high integrity impact (I:H) is real once the full chain executes, but the dependency on a preceding renderer exploit means attackers must already have significant capability before this flaw adds value. Priority should be standard patch cadence rather than emergency response, unless the environment involves high-value targets where sophisticated chained Chrome exploits are a realistic threat model.

An attacker first exploits a separate renderer-process vulnerability to gain code execution within Chrome's sandboxed renderer. They then deliver or redirect the victim to a crafted PDF file - triggering Chrome's internal PDF renderer - which exercises the missing authorization path in the InterestGroups API, allowing the attacker to bypass system access restrictions and achieve high integrity impact beyond the renderer sandbox. No public POC for this specific chained sequence has been identified at time of analysis.