Google Chrome CVE-2026-79028

Exploitation requires that the victim actively navigate to an attacker-controlled HTML page (UI:R), making drive-by exploitation dependent on social engineering or malvertising. Attack complexity is rated High (AC:H), meaning success depends on specific environmental or timing conditions beyond the attacker's full control - likely requiring repeated attempts or precise network conditions. No authentication is required from the attacker's side (PR:N), and the attack is initiated over the network. Exploitation is limited by: (1) the victim must visit the crafted page, ruling out fully passive attacks; (2) the high complexity requirement means automated, reliable exploitation at scale is not feasible per SSVC; (3) Chrome versions 152.0.7977.65 and later are not affected. No special server-side configuration of the victim application is required - the vulnerability resides in Chrome's network stack client-side.

The CVSS 3.1 base score of 5.3 (Medium) accurately captures the constrained nature of this vulnerability. AV:N confirms the attack is network-reachable, but AC:H is the critical limiting factor - exploitation depends on specific environmental conditions, likely precise timing windows or particular network configurations, which substantially reduces automation potential. UI:R imposes an additional barrier requiring the victim to navigate to an attacker-controlled page. SSVC explicitly rates Automatable as 'no,' corroborating that mass exploitation is implausible. EPSS at 0.31% (23rd percentile) places this well below the threshold of likely active exploitation, and the CISA KEV does not list this CVE. The C:H impact metric reflects that successful exploitation could yield meaningful cross-origin data leakage, but the high complexity gate means opportunistic exploitation is unlikely. The net assessment is a low-to-medium operational priority: patch within normal browser update cadence rather than treating it as an emergency, unless the environment involves users accessing highly sensitive cross-origin resources on untrusted networks.

An attacker crafts an HTML page that leverages network-level observable discrepancies - such as differential timing or connection behavior - to infer whether a victim's browser has recently accessed specific cross-origin resources or holds particular session-linked network state. The victim is socially engineered into visiting the malicious page, and the attacker's JavaScript measures timing or behavioral differences to reconstruct sensitive information. No public exploit code has been identified, and the high complexity requirement means reliable exploitation depends on precise environmental tuning.