Google Chrome CVE-2026-79090

Exploitation requires the victim to be running a Chrome build older than 152.0.7977.65 AND to be social-engineered into loading an attacker-crafted HTML page - the description explicitly cites 'social engineering' and a 'crafted HTML page,' so successful user interaction (navigating to the page) is a hard prerequisite. Limiting factors: the attack is not automatic or drive-by-guaranteed because it depends on human action, Chromium rates the impact as Low, and there is no authentication bypass of a server - the target is the local browser trust boundary. This meaningfully constrains real-world risk despite the 9.8 CVSS number, whose UI:N metric appears inconsistent with the interaction-dependent description.

The signals conflict materially and should be reconciled before prioritization. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) implies unauthenticated, no-interaction, total compromise - but the description explicitly requires 'social engineering' and a 'crafted HTML page' (i.e., user interaction), and Chromium itself labels the issue 'Low' severity. This strongly suggests the 9.8 is an inflated/auto-generated score and UI:N is incorrect; realistic risk is far lower. Supporting that: EPSS is only 0.21% (11th percentile), SSVC shows Exploitation=none, and there is no KEV listing or POC. Countervailing factors are that SSVC marks it Automatable=yes with Technical Impact=total, and Chrome's enormous install base means even a low-probability bug warrants routine patching - an ordinary mid-sized IT operator should still deploy the update on its normal Chrome cadence, but this does not warrant emergency out-of-band response. Bottom line: treat as a standard-priority browser update, not a critical drop-everything item, and verify the true impact against the vendor advisory given the CVSS-vs-vendor-severity mismatch.

An attacker crafts a malicious HTML page and lures a Chrome user (via phishing link, malvertising, or a compromised site) into opening it; when rendered, the page abuses the Actor privilege-management flaw to perform an action outside the restrictions normally imposed on web content. No public exploit code is identified, and success depends on the victim actively visiting the attacker-controlled page.