Google Chrome CVE-2026-79041

Exploitation requires a macOS user running Google Chrome prior to 152.0.7977.65 - Windows and Linux are not affected per the CVE description. The victim must actively visit a crafted HTML page through social engineering (phishing, malicious link, or drive-by redirect), as CVSS UI:R confirms mandatory user interaction. The attacker requires no authentication or prior access (PR:N). Limiting factors include: the mandatory social engineering step rules out automated or mass exploitation; impact is restricted to integrity only, with no data exfiltration or service disruption; and exploitation is platform-gated to macOS Chrome instances specifically.

The CVSS 4.3 (Medium) vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N accurately characterizes a network-reachable flaw that requires active victim interaction (UI:R) and produces only limited integrity impact - no confidentiality or availability degradation is indicated. EPSS at 0.26% (18th percentile) strongly corroborates low real-world exploitation activity; this is well below thresholds typically associated with actively targeted vulnerabilities. There is no CISA KEV listing, and no POC code has been identified, making this a theoretical-to-low-probability threat in practice. The mandatory social engineering prerequisite (UI:R) eliminates automated or mass-scanning exploitation paths. The scope is contained (S:U), meaning there is no lateral pivot or container/VM escape potential. Overall, this is a genuine but low-urgency finding: chromium-rated 'Low' severity aligns with the evidence. Prioritize patching as part of routine Chrome update cycles rather than emergency response.

An attacker crafts a malicious HTML page designed to trigger Chrome's missing authorization check and hosts it at an attacker-controlled domain. The victim on macOS running Chrome prior to 152.0.7977.65 is lured to the page via phishing email, malicious advertisement, or social media link. Upon page load and victim interaction, the page bypasses the web origin policy, gaining unauthorized read or write access to a privileged browser page and achieving a limited integrity impact on the victim's browser state.