Google Chrome CVE-2026-79056

The concrete prerequisite from the description is that the victim must load a crafted HTML page in a vulnerable Chrome build (before 152.0.7977.65) that exercises the ServiceWorker code path - the CVSS UI:R metric confirms user interaction (navigating to the attacker-controlled page) is mandatory, so this cannot be triggered without the victim opening content. No authentication is required (PR:N), and it works against default Chrome configurations since ServiceWorker is standard functionality. Limiting factors: exploitation depends on the victim visiting attacker content, on the specific timing/heap conditions needed to turn a use-after-free into controlled execution (Chromium's Low severity rating implies reliable exploitation is not straightforward), and on the target still running a pre-152.0.7977.65 desktop build; environments that block untrusted sites or that have auto-updated are effectively out of reach.

Signals here are in tension and must be reconciled rather than taken at face value. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) portrays a network-reachable, low-complexity, unauthenticated sandbox escape, yet Chromium's own triage labels the security severity Low, and CISA's SSVC record lists Exploitation: none, Automatable: no, Technical Impact: total. The SSVC 'total' technical impact aligns with the RCE claim, but 'none/no' for exploitation and automatability, combined with the absence of any KEV listing or public POC, argues this is not currently a mass-exploited threat. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here and should be pulled from FIRST EPSS before final prioritization. The realistic read: this is a serious memory-corruption RCE that warrants prompt patching because Chrome is everywhere and browser bugs are attractive targets, but the low Chromium rating and 'potentially execute' hedging suggest exploitation is non-trivial and not yet demonstrated - even a resource-constrained mid-sized IT team should schedule the update quickly, while treating the raw 9.6 as an upper bound rather than a confirmed field-exploited emergency. The CVSS AC:L versus the practical difficulty of weaponizing a use-after-free is the key conflict to flag to stakeholders.

An attacker registers a malicious website or compromises an ad/third-party script and lures a victim running a vulnerable Chrome build to open the page (e.g., via phishing link or malvertising). The crafted HTML drives ServiceWorker operations that trigger the use-after-free, and by grooming the heap the attacker reclaims the freed object to hijack execution and break out of the sandbox onto the host. No public exploit is currently identified, and the low-complexity CVSS rating is tempered by the practical difficulty of reliably weaponizing a use-after-free.