Google Chrome CVE-2026-79108

Exploitation requires the victim to be running Google Chrome prior to version 152.0.7977.65 and to actively visit and interact with a crafted HTML page that initiates a WebAuthn authentication ceremony. The Chrome Web Authentication feature must be invoked - meaning the target must have a site or context that triggers a Passkey or Security Key flow, or be deceived into doing so. The mandatory user interaction (CVSS UI:R) means the attack cannot succeed without the victim approving the misrepresented WebAuthn prompt; a security-aware user who scrutinizes origin displays before confirming may interrupt the attack. Exploitation is further limited by the social engineering requirement: the attacker must successfully deceive the user into trusting the manipulated dialog. No authentication to attacker infrastructure is required (PR:N). Non-default configuration is not a prerequisite - the Web Authentication feature is enabled by default in Chrome - but the attack only matters if the user holds Passkeys or Security Keys for accounts the attacker wishes to target.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N scores 6.5 Medium: network-reachable, low complexity, no attacker privileges, but mandatory user interaction limiting opportunistic exploitation. The Integrity:High rating reflects the severity of an authentication bypass if successful. Multiple signals substantially dampen real-world urgency: Chromium's own team rated this Low severity - a notable divergence from the 6.5 CVSS score - and EPSS sits at just 0.22% in the 12th percentile, meaning fewer than one in eight known CVEs has a lower exploitation probability. There is no CISA KEV listing and no public proof-of-concept identified at time of analysis. The social engineering dependency (UI:R) eliminates opportunistic mass exploitation; attackers must actively deceive a user into interacting with the spoofed WebAuthn prompt. EPSS and Chromium's own Low severity designation are in alignment, suggesting this is a low-priority patch rather than an emergency response - though routine patch hygiene remains advisable given Chrome's ubiquity.

An attacker registers a malicious website that initiates a WebAuthn authentication ceremony and crafts the HTML page to cause Chrome's dialog to misrepresent the relying party origin or credential type. A phishing email or malicious ad directs a target running a pre-152.0.7977.65 Chrome build to the site; the user, seeing a Passkey or Security Key prompt they believe is legitimate, approves the ceremony, inadvertently binding an attacker-controlled credential or authorizing unintended authentication. No public proof-of-concept exploit code has been identified at time of analysis, requiring the attacker to independently develop the UI spoofing technique.