Google Chrome CVE-2026-79139

Exploitation requires two sequential conditions to be satisfied: first, the attacker must have independently compromised the Chrome renderer process (a separate, prerequisite vulnerability not covered by this CVE); second, the victim must visit or be redirected to a crafted HTML page while using a Chrome version on Windows prior to 152.0.7977.65. User interaction is required (UI:R) - the victim must open the malicious page. This vulnerability is Windows-specific and does not affect Chrome on other operating systems. The key limiting factor is the renderer compromise prerequisite: this is not a standalone exploit but a sandbox escape component of a larger exploit chain. The attack is not automatable at scale (SSVC: Automatable: no) and requires high attack complexity (CVSS AC:H) due to the chained nature of the attack.

The CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately captures the high complexity of this attack - it requires both user interaction and a pre-compromised renderer process, making it inherently a chained exploit rather than a standalone vector. S:U in the provided vector is arguably underscored, as sandbox escape by definition crosses security boundaries, which typically warrants S:C; analysts should treat the real-world impact as equivalent to a full sandbox escape regardless of the vector notation. EPSS at 0.26% and SSVC 'Exploitation: none' together strongly indicate this has not been observed in the wild and is not currently weaponized. SSVC 'Automatable: no' further confirms that mass exploitation at scale is not feasible without a renderer compromise precondition. Despite the high potential impact (SSVC Technical Impact: total), the compounded prerequisites - Windows-only, user interaction, and requiring a chained renderer exploit - materially reduce real-world exploitation probability relative to the CVSS score alone. Priority should focus on rapid patching of Chrome on Windows endpoints rather than emergency incident response.

An attacker first compromises a victim's Chrome renderer process on Windows - for example, by chaining this attack with a separate renderer exploit delivered via a malicious or attacker-controlled website. Once the renderer is compromised, the attacker's crafted HTML page triggers the Media component's improper input validation flaw, causing code to execute outside the Chrome sandbox with broader OS-level access. No public proof-of-concept code has been identified, and this scenario requires successful execution of a prior renderer exploitation stage, making opportunistic mass exploitation unlikely at this time.