Google Chrome CVE-2026-79143

The victim must be running Google Chrome prior to version 152.0.7977.65 on a desktop platform. The sole prerequisite for exploitation is that the victim navigates to an attacker-controlled HTML page - this is the user interaction (CVSS UI:R) that limits opportunistic exploitation. No special Chrome configuration, non-default settings, or authenticated session is required on the attacker side (PR:N, AC:L). The primary limiting factor is the social-engineering dependency: the attacker must convince the user to visit the crafted page. Impact is bounded to integrity (I:L) - unauthorized filesystem writes within the scope of the bypass - with no confidentiality exposure or service disruption.

The CVSS 3.1 base score of 4.3 (Medium) is internally consistent: network-delivered (AV:N), low complexity (AC:L), no attacker privileges required (PR:N), but user interaction required (UI:R), with limited integrity impact only (I:L) and no scope change. The UI:R requirement is the primary risk-dampening factor - opportunistic mass exploitation is constrained because the victim must visit a crafted page. EPSS at 0.27% (19th percentile) corroborates low current exploitation interest. Absence from CISA KEV and no referenced POC further reduce urgency. Despite Chrome's ubiquitous deployment footprint, the combination of medium CVSS, low EPSS, user-interaction dependency, and integrity-only impact makes this a routine patch-cycle priority rather than an emergency response item. No conflicting signals were identified in the available intelligence.

An attacker registers a domain and hosts a crafted HTML page that triggers Chrome's FileSystem authorization flaw when rendered by the browser. The attacker delivers the link via phishing email or malicious advertisement, and once the victim navigates to the page, the authorization bypass executes without further interaction, allowing the page to perform unauthorized filesystem writes beyond its sandboxed origin. No public proof-of-concept code has been identified at time of analysis.