Google Chrome CVE-2026-79132

Exploitation requires two chained preconditions: (1) the attacker must have already achieved code execution within Chrome's renderer process on Android, which itself requires a separate exploitable renderer-level vulnerability; and (2) the victim must navigate to or be delivered a crafted HTML page while within that compromised renderer context (UI:R per CVSS). Chrome on Android prior to version 152.0.7977.65 must be in use. No non-default configuration is required for the sandbox escape itself, but the mandatory renderer pre-compromise acts as a significant practical barrier to exploitation, explaining both AC:H in the CVSS vector and SSVC's 'automatable: no' determination. Exploitation is limited to the Android platform; desktop Chrome is not in scope.

The CVSS 3.1 score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects theoretically severe impact tempered by high attack complexity - AC:H captures the prerequisite renderer compromise, which demands a separately exploitable renderer vulnerability before this sandbox escape can be leveraged. SSVC corroborates this: exploitation status is 'none' and automatable is 'no', while technical impact is rated 'total,' meaning successful exploitation grants unrestricted access beyond the sandbox. EPSS at 0.25% (16th percentile) is consistent with a chained, non-trivially reproducible exploit chain and places this well below typical exploitation thresholds. No KEV listing confirms there is no observed in-the-wild exploitation. The gap between the high CVSS score and the low EPSS and SSVC exploitation signals is a classic marker of a theoretically severe but practically constrained chained vulnerability - organizations managing Android Chrome fleets should apply the available patch on their standard update cycle, but this does not warrant emergency out-of-band response in the absence of confirmed exploitation evidence.

An attacker first exploits a separate renderer vulnerability in Chrome for Android - such as a V8 type confusion or memory corruption bug - to establish code execution within the sandboxed renderer process, then delivers a crafted HTML page that triggers the improper input validation flaw to escape the sandbox and execute arbitrary code at the Android OS privilege level. No public proof-of-concept for this specific two-stage exploit chain has been identified at time of analysis.