Google Chrome CVE-2026-79022

Exploitation requires the victim to be running Google Chrome prior to 152.0.7977.65 and to visit an attacker-controlled or attacker-crafted HTML page - user interaction is a hard prerequisite (CVSS UI:R). The vulnerable component is specifically Chrome's Transactions Platform, meaning the spoofing is triggered in the context of payment or transaction UI rendering within the browser; pages that do not invoke that subsystem are not a trigger surface. The attacker requires no authentication or privileges (CVSS PR:N) but must successfully deliver a social engineering lure to induce the user to visit the page and interact with the spoofed UI. Exploitation is limited to unpatched Chrome versions; browsers updated to 152.0.7977.65 or later are not affected. No server-side misconfiguration or special deployment mode is required.

The CVSS 4.3 Medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) is consistent with Chromium's own 'Low' severity rating: network-reachable, low complexity, but gated entirely on user interaction and producing only limited integrity impact. EPSS at 0.29% (21st percentile) reinforces that real-world exploitation probability is low at this time. No CISA KEV listing and no public exploit code has been identified, making this a patch-and-move-on issue for most organizations rather than an emergency response trigger. The social engineering prerequisite is a meaningful friction point - attackers must lure a victim to a crafted page and the victim must interact with the spoofed transaction UI. That said, payment-UI spoofing has clear monetization pathways (credential theft, fraudulent transaction approval), so the theoretical attacker motivation is non-trivial. Organizations running managed Chrome fleets should confirm auto-update delivery to 152.0.7977.65 rather than treating this as urgent manual remediation.

An attacker builds a crafted HTML page that triggers Chrome's Transactions Platform to render spoofed payment confirmation UI, making a fraudulent transaction or credential prompt appear legitimate. The victim is directed to this page via phishing - email, social media, or a compromised ad - and interacts with the spoofed interface, potentially approving a fraudulent payment or submitting payment credentials to the attacker. No public exploit code has been identified at time of analysis, and the attack depends entirely on successful social engineering.