Google Chrome CVE-2026-79069

Exploitation is limited to Google Chrome on macOS - other platforms (Windows, Linux, Android, iOS) and other Chromium-based browsers are not confirmed affected by this specific issue. The victim must visit an attacker-controlled or attacker-compromised HTML page (UI:R), but no authentication, login, or special browser configuration is required beyond running a vulnerable Chrome version on macOS. No Chrome flags or experimental features need to be enabled; normal WebGPU-capable browser operation is sufficient. What limits exploitation: macOS-only scope reduces the target population, and the user-interaction requirement (victim must navigate to the malicious page) prevents fully automated mass exploitation without a delivery mechanism such as phishing or malvertising.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects straightforward network-reachable exploitation requiring only that the victim visit a malicious page - no authentication and low attack complexity. However, the provided CVSS marks scope as Unchanged (S:U), which conflicts with the description's explicit claim of code execution 'outside the sandbox.' Sandbox escape logically implies S:C and would raise the score to approximately 9.6; this discrepancy should be verified against the Chromium bug tracker. EPSS at 0.25% (16th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis, consistent with a freshly patched browser vulnerability. The absence of public POC keeps real-world risk moderate today, but browser memory corruption bugs with sandbox escape potential are historically attractive to exploit kit authors and targeted threat actors, so patching urgency remains high for Mac Chrome deployments.

An attacker hosts a webpage containing crafted HTML and WebGPU shader content designed to trigger memory corruption in Chrome's Tint library during page rendering. When a macOS user visits the page - through a phishing link, malvertising, or a compromised site - the Tint component processes the malicious content, corruption occurs in memory, and the attacker achieves arbitrary code execution that breaks out of Chrome's renderer sandbox and runs at the OS user's privilege level. No public proof-of-concept has been identified at time of analysis.