Google Chrome Android CVE-2026-79142

The target must be running Google Chrome for Android in any version prior to 152.0.7977.65. No special Chrome configuration, non-default feature flag, or elevated device permission is required - default Chrome for Android installations on unpatched devices are vulnerable. The CVSS vector PR:N confirms no attacker authentication is required; UI:R confirms the victim must actively navigate to (or be redirected to) the attacker-controlled page, meaning passive network interception alone is insufficient as an attack vector. Exploitation is limited to the Android platform; Chrome on desktop operating systems is not affected by this issue. The key limiting factor is the UI:R requirement combined with the current absence of public exploit code, which raises the practical bar for opportunistic mass exploitation relative to what the CVSS score alone suggests.

The official CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) contains a notable internal inconsistency: the S:U (scope unchanged) designation conflicts with the CVE description's explicit statement that code executes 'outside the sandbox,' which is definitionally a scope change under CVSS 3.1 semantics and should be scored S:C - this discrepancy is unresolved in the available references and should be verified with Google's security team. EPSS at 0.28% (20th percentile) is low, consistent with an early-stage disclosure before weaponized code proliferates, rather than an indication of inherent low exploitability. Active exploitation is not confirmed (no CISA KEV listing), and no public exploit code has been identified, meaning practical exploitation currently demands significant attacker capability; however, browser heap overflow primitives in a widely-studied codebase like Chrome can be developed by well-resourced threat actors. The combination of no-authentication-required network access, low attack complexity, user-interaction-only barrier, and a sandbox-escape outcome means any Android Chrome user below the patched version on an unmanaged or slow-patching mobile fleet faces meaningful risk, and rapid deployment of the 152.0.7977.65 update should be treated as urgent.

An attacker registers or compromises a website and embeds a crafted HTML page containing malformed WebGL operations designed to trigger a heap overflow in Chrome's ANGLE graphics layer. A victim on an unpatched Android device visits the page via a phishing link or malicious advertisement, the overflow is triggered in the renderer process, and the attacker achieves code execution outside the Chrome sandbox - gaining access to the device at Chrome's process privilege level, enabling credential theft, surveillance, or further lateral movement. No public exploit code has been identified at time of analysis, so current exploitation requires attacker-developed tooling against this specific target.