Google Chrome CVE-2026-79076

Exploitation requires the target to be running Google Chrome prior to 152.0.7977.65 with the Chrome Sync feature enabled and the user signed into a Google account, since the Sync subsystem is only active in this configuration. User interaction is required per CVSS UI:R - the victim must trigger or be subject to a Sync-related action while receiving attacker-controlled network traffic; this is not a silent background exploit. Users who have disabled Sync via enterprise policy or who have not signed into Chrome are not affected. The exact interaction mechanism (specific URL visit, background Sync poll, push notification) is not independently confirmed as Chromium issue 496395158 details may be access-restricted. Exploitation is limited to information disclosure - no write capability or service disruption is expected from this flaw.

The CVSS 6.5 score captures a medium-severity network-accessible flaw with high confidentiality impact, but several signals constrain real-world priority. The UI:R requirement means an attacker cannot exploit this silently in the background - some form of user engagement with the crafted traffic is necessary, raising the bar for opportunistic campaigns. EPSS at 0.25% (16th percentile) reflects low near-term weaponization likelihood, consistent with the absence of a KEV listing and no identified public exploit code. The S:U scope means impact is contained to the vulnerable Chrome instance rather than propagating to adjacent systems. Chrome's auto-update mechanism significantly shortens enterprise exposure windows for consumer endpoints; organizations using managed deployment with delayed rollout policies carry higher residual risk and should prioritize update verification. The high C impact (potentially synced credentials) is the most material concern and warrants prompt patching even absent active exploitation evidence.

An attacker positions themselves to deliver crafted network traffic to a Chrome user - for example via a malicious website, a man-in-the-middle position on an untrusted network, or injected Sync server responses - causing Chrome's Sync input validation to misprocess the payload and return or expose sensitive synchronized data such as saved passwords or browsing history. The UI:R requirement suggests the user must take some action (e.g., navigate, trigger a Sync operation) in a context where the malformed traffic is active. No public exploit code exists at time of analysis, so exploitation currently requires custom tooling.