Google Chrome CVE-2026-79140

Exploitation requires the victim to actively load attacker-controlled content - a crafted HTML page - in Google Chrome for macOS on a version below 152.0.7977.65 (UI:R in the CVSS vector confirms required user interaction). No authentication is needed (PR:N), and the attack is remote over the network (AV:N) with low complexity (AC:L). Limiting factors: it only applies to vulnerable Mac Chrome builds, the user must be enticed to visit the page (no zero-click), and per CISA SSVC the attack is not automatable, so it favors targeted lures over mass, wormable exploitation.

Signals here are mixed and should be weighed carefully rather than reacting to the headline 9.6. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C, C/I/A all High) is severe because a single crafted page yields a sandbox escape, and the 9.6 is inflated by the Changed scope. However, corroborating signals argue against panic: Chromium rated it Medium severity, EPSS is only 0.41% (34th percentile), CISA SSVC records Exploitation as 'none' and Automatable as 'no' (mass-scan/worming is not straightforward because UI:R means a user must be tricked into visiting content), and it is not in KEV. Technical Impact is 'total,' consistent with full RCE if triggered. The realistic prioritization is a prompt but routine browser patch cycle: any organization running Chrome on Mac should treat this as an urgent-but-standard update rather than an emergency, since exploitation requires user interaction and no weaponized exploit is known. No signals are directly conflicting, but note the tension between NVD's 9.6 and Chromium's Medium rating - the latter reflects the practical exploitation difficulty.

An attacker hosts a malicious web page that grooms the browser heap and triggers the Views use-after-free, then serves the link via phishing, malvertising, or a compromised site. When a macOS Chrome user on a vulnerable version visits the page, the dangling pointer is exploited to escape the sandbox and execute code with browser-process privileges. No public proof-of-concept is identified at time of analysis, and success depends on the victim actually loading the attacker's content (UI:R).