Google Chrome Android CVE-2026-79089

Target must be running Google Chrome on Android in a version prior to 152.0.7977.65. The attacker must successfully social-engineer the victim into navigating to or loading a crafted HTML page (UI:R per CVSS). The exploit relies on winning a race condition in the Transactions Platform subsystem, which requires precise timing and makes reliable, automated exploitation difficult (AC:H). Per the CVSS vector PR:N, no authentication or account on the target system is required - the entire attack is initiated from the remote web page. Desktop Chrome and non-Android platforms are not confirmed affected by this specific issue. The limiting factors - mandatory user interaction via social engineering and a high-complexity race window - significantly constrain both opportunistic and automated mass exploitation.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) yields a 5.3 medium score, and the metrics tell a nuanced story. AC:H correctly reflects the inherent difficulty of winning a race condition in a timing-sensitive browser subsystem, and UI:R means an attacker cannot operate without social engineering. The integrity impact is High, but there is no confidentiality or availability component, and scope is unchanged. EPSS at 0.18% (7th percentile) aligns with Chromium's own Low severity classification, indicating this is not a priority exploitation target. There is no CISA KEV listing and no known public proof-of-concept. The combination of high attack complexity, required user interaction, and very low EPSS makes this a low real-world priority despite the elevated integrity score - it is not a 'high-CVSS-but-low-risk' case since the CVSS itself is only medium, and all secondary signals corroborate low urgency.

An attacker hosts a crafted HTML page and lures an Android Chrome user to it via phishing link or malicious advertisement. Upon page load, JavaScript triggers a sequence that races Chrome's Transactions Platform permission-check window, and if the timing is won, the attacker's page gains capabilities beyond its granted access restrictions - for example, executing privileged transactions or bypassing sandbox boundaries for data writes. No public proof-of-concept exists, and the high attack complexity (AC:H) means reliable exploitation requires careful environmental tuning.