Google Chrome CVE-2026-79072

Exploitation requires the victim to visit a crafted HTML page using an affected Chrome version (prior to 152.0.7977.65); this is the sole mandatory precondition beyond an unpatched browser. The CVSS UI:R metric confirms user interaction is required - the attacker cannot trigger exploitation passively without the user navigating to the malicious content. No authenticated session, installed extension, or non-default Chrome configuration is required. Exploitation is constrained to reading memory within the Chrome renderer sandbox (S:U), limiting accessible data to in-process browser state rather than host OS memory or other processes. Chrome's sandbox itself is not bypassed by this flaw.

The nominal CVSS 8.1 score is driven by AV:N/AC:L/PR:N and the high C:H/I:H impact ratings, but several factors moderate the real-world priority. First, the I:H (Integrity: High) assignment in the vendor-reported vector appears inconsistent with the description, which characterizes the flaw purely as a memory read (information disclosure); this discrepancy should be verified with Google's security team. Second, scope is Unchanged (S:U), meaning exploitation is bounded within the Chrome sandbox - a meaningful architectural barrier against host-level compromise. Third, EPSS at 0.22% (13th percentile) indicates the broader security community does not currently observe active exploitation tooling targeting this CVE. Fourth, UI:R requires the victim to actively navigate to a malicious page, adding a social-engineering dependency. Taken together, even a mid-sized municipal IT team should treat patch deployment as a standard monthly cycle priority rather than an emergency out-of-band response, absent threat-intelligence signals suggesting active targeting.

An attacker hosts a crafted HTML page containing JavaScript that triggers abnormal state transitions in Chrome's Performance API. A victim is directed to the page via phishing link, malicious advertisement, or compromised site. The improper state validation causes the Performance subsystem to reference and expose portions of the renderer process memory, potentially leaking session tokens, authentication cookies, or page content cached in the Chrome heap - all without requiring any installed software or elevated privileges on the victim's system.