Google Chrome CVE-2026-79126

Exploitation requires the attacker to be adjacent to the victim's network - on the same subnet, VLAN, or wireless segment - and able to inject or observe crafted network traffic. The vulnerability is Windows-platform-specific; Chrome on other operating systems is not affected. The flaw resides in the Proxy component, suggesting that proxy functionality must be in use or at least active in the browser context. High attack complexity (AC:H from the CVSS vector) indicates that specific, non-trivial network conditions must be met. There is no requirement for user interaction or authentication. Exploitation is constrained by: (1) physical or logical network adjacency, (2) Windows platform requirement, and (3) high complexity crafted-traffic conditions - collectively ruling out remote, opportunistic, or mass-exploitation scenarios.

The provided CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 5.9 but conflicts with the description, which explicitly states 'adjacent attacker' - indicating the realistic attack vector is AV:A, not AV:N. Correcting for AV:A reduces the base score to approximately 5.3. EPSS at 0.13% (3rd percentile) confirms very low real-world exploitation probability. There is no CISA KEV listing and no public exploit code, further reducing urgency. The Chromium team itself rates this Low severity. Attack complexity is High, requiring crafted network traffic under specific adjacency conditions. Taken together, these signals indicate a low operational priority for most organizations - patch in the normal update cycle rather than as an emergency. The confidentiality impact is rated High by NVD, but this is partially offset by the adjacency and high-complexity requirements that an attacker must satisfy simultaneously.

An attacker physically or logically adjacent to the victim's network segment - for example, on the same Wi-Fi access point or LAN segment - sends specially crafted network traffic that exploits Chrome's proxy misimplementation on Windows, causing the browser to leak sensitive information such as request content or credentials. No public proof-of-concept code has been identified, and the high attack complexity means the attacker must engineer precise network conditions. Exploitation is most plausible in environments with open or shared network access, such as corporate Wi-Fi or public hotspots.