Google Chrome CVE-2026-79144

Exploitation requires the victim to actively visit a crafted HTML page using a vulnerable Chrome version prior to 152.0.7977.65 - no drive-by execution without user navigation is possible given UI:R. No attacker-side authentication or elevated privileges are required (PR:N). For the leak to yield meaningful data, the victim must also be authenticated to the cross-origin resource being targeted at the time of the attack, since an unauthenticated cross-origin resource would expose no sensitive information regardless of the Skia flaw. The scope of extractable data is bounded to what Skia renders graphically - consistent with pixel-readback or canvas data - rather than arbitrary JavaScript-accessible DOM content, cookies, or HTTP response bodies, which limits the utility of successful exploitation. No non-default browser configuration is required; default Chrome installations on all platforms are vulnerable.

The CVSS 4.3 Medium rating with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N is internally consistent: the attack is network-delivered without requiring attacker authentication, but UI:R (user must visit the attacker's page) and S:U (scope unchanged, no privilege boundary crossed) meaningfully cap real-world impact. The low EPSS score of 0.22% at the 13th percentile aligns with the absence of a KEV listing and no reported public exploit - this is not a vulnerability under active mass exploitation. The low confidentiality impact metric (C:L) reflects that extracted data is likely pixel-level or graphics-buffer content rather than arbitrary DOM, cookies, or session tokens, further narrowing the practical intelligence yield. Overall, this is a patch-cycle-normal issue rather than an emergency: organizations should update Chrome on their standard cadence without emergency exception procedures.

An attacker hosts a crafted HTML page that embeds or references content from a target cross-origin resource - such as a corporate intranet page or authenticated web application visible only to logged-in users. A victim running a vulnerable Chrome version is lured to this page via a phishing link or malicious advertisement; the attacker's JavaScript then exploits the Skia rendering leak to read pixel or canvas data from the cross-origin resource rendered by Chrome, gradually exfiltrating visual content without the victim's awareness. No public exploit code has been identified, so real-world execution of this scenario likely requires custom exploit development.