Google Chrome CVE-2026-79118

Exploitation requires that a victim user actively opens a crafted HTML page in an unpatched Google Chrome version prior to 152.0.7977.65; passive drive-by exploitation without any user-initiated navigation is not possible given the UI:R requirement. The ANGLE graphics layer is enabled by default in Chrome for hardware-accelerated WebGL and canvas rendering, so no non-default configuration is needed on the victim side. The attacker requires no authentication or account privileges. Exploitation is strictly limited to cross-origin data disclosure - code execution is not achievable through this vector. Environments where Chrome's GPU acceleration is disabled via enterprise policy (chrome://policy, DisableGpuRasterization), or where strict URL filtering prevents navigation to untrusted origins, have materially reduced exposure. The scope change metric is Unchanged (S:U), meaning the exploit cannot pivot to affect the underlying operating system or other processes.

The CVSS 3.1 score of 4.3 (Medium) correctly reflects a network-reachable, low-complexity attack with no required privileges but a mandatory user interaction step (UI:R) and limited confidentiality impact (C:L) with zero integrity or availability exposure. The EPSS score of 0.24% at the 15th percentile aligns with no confirmed public exploit code and no CISA KEV listing, indicating this is not subject to widespread active exploitation at time of analysis. Real-world impact is bounded: an attacker can leak cross-origin data but cannot achieve code execution or persistent access through this vector alone. The practical risk is highest in browsing contexts where multiple origins are simultaneously active - authenticated banking sessions, SaaS dashboards, or credential management pages - where leaked cross-origin content could enable session data harvesting. Priority is appropriate for standard enterprise patch cycles rather than emergency response, though the ubiquity of Chrome as the dominant global browser means the raw population of potentially exposed endpoints is enormous.

An attacker publishes a crafted webpage containing WebGL or graphics API calls designed to trigger the ANGLE uninitialized buffer condition, then lures a victim into visiting the page via phishing, malvertising, or a compromised site. When Chrome processes the page's graphics instructions, residual memory from a concurrently loaded cross-origin context is exposed, and attacker-controlled JavaScript reads and exfiltrates that data. No confirmed public POC exists at time of analysis, but the attack surface - any Chrome user visiting any webpage - is extremely broad.