Google Chrome CVE-2026-79130

Exploitation requires the victim to load attacker-controlled HTML/graphics content in a vulnerable Google Chrome build (before 152.0.7977.65) - the CVSS vector's UI:R confirms required user interaction, so this is not zero-click or wormable. No authentication or prior privileges are needed (PR:N): any remote attacker who can get a user to open a crafted page can attempt it against a default Chrome configuration. The concrete prerequisite is that the ANGLE graphics path processes the malicious content; environments that disable hardware/graphics acceleration reduce the attack surface. Limiting factors: the mandatory user interaction, the need for the target to be on an unpatched version (Chrome's default auto-update sharply narrows the exposure window), and reliance on successful heap grooming to turn memory corruption into reliable code execution.

The signals partially conflict and must be weighed together. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H → 9.6) is severe primarily because of the scope change (S:C): the description explicitly states code execution occurs OUTSIDE the sandbox, which is the worst-case outcome for a browser bug. Against that, EPSS is only 0.28% (20th percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced - meaning there is currently no evidence of active exploitation or readily available exploit code. The one hard mitigating factor is UI:R: exploitation requires the victim to actively visit or load attacker-controlled content, so this is not wormable or zero-click. The practical reading: this is a genuine high priority for patching because of the sandbox-escape potential and Chrome's ubiquity, but the real-world exploitation probability today is low and likely to remain targeted rather than mass-scale unless a POC emerges. Because Chrome auto-updates, most managed and consumer fleets will remediate quickly; any operator running pinned or enterprise-frozen Chrome versions should prioritize pushing the update rather than waiting for a KEV listing to justify action.

An attacker hosts a malicious web page (or injects malicious content into an ad or compromised site) containing crafted graphics/WebGL commands that trigger the ANGLE heap overflow. When a victim on a pre-152.0.7977.65 Chrome browser visits the page, the overflow corrupts heap memory and executes attacker code that escapes the renderer sandbox onto the host. No public POC is currently referenced, and success requires the user to load the page (UI:R), so delivery typically relies on phishing or watering-hole tactics.