Google Chrome CVE-2026-79087

Victim must actively visit an attacker-controlled or attacker-influenced HTML page using a Chrome version prior to 152.0.7977.65 (user interaction is mandatory per UI:R). No authentication credentials, browser extensions, or non-default settings are required by the attacker. The attack is network-delivered (AV:N) with low complexity (AC:L), meaning no special network positioning or race conditions are needed. What limits exploitation: the victim must take action (visit a page), impact is confined to low integrity within the browser's unchanged scope (S:U), and there is no confidentiality or availability impact. The bypass affects system access restrictions within the Tabs subsystem only; full sandbox escape is not implied by available data.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects a low-severity but broadly reachable flaw: no privileges or special network position are needed, complexity is low, but a user must actively visit a malicious page and scope does not escape the browser. EPSS at 0.38% (31st percentile) corroborates that automated or widespread exploitation is unlikely. There is no CISA KEV listing and no reported POC. The 'Authentication Bypass' tag aligns with the description's 'bypass system access restrictions' language but the bypass impact is bounded to low integrity (I:L), not full authentication circumvention. Real-world prioritization should be moderate: patch during the next routine browser update cycle rather than emergency deployment. The primary concern is Chrome's ubiquitous footprint amplifying even low-probability exploitation across a massive user base.

An attacker hosts a crafted HTML page that, when loaded by a Chrome user, triggers an injection condition within the browser's Tabs component, allowing a limited bypass of system access restrictions. Because UI:R is required, the attacker must socially engineer the victim into visiting the page, for example via phishing email or a compromised advertisement. No public exploit code exists at time of analysis, so exploitation would currently require independent vulnerability research to reproduce.