Google Chrome CVE-2026-79154

Exploitation requires the victim to be running Google Chrome in a version prior to 152.0.7977.65 on any desktop platform. The victim must be socially engineered into performing a specific UI interaction within the DevTools interface - the attack cannot be triggered silently or automatically. The PR:N CVSS metric confirms the attacker needs no authentication to Chrome or the target system. What limits exploitation: the UI:R constraint means victim participation is mandatory and cannot be bypassed, preventing automated mass exploitation; the unchanged scope (S:U) means the attacker's access is bounded to the browser session and does not directly extend to the underlying OS or other system resources; and no public exploit code exists to lower the technical bar for attackers.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5 (Medium), reflecting a network-accessible flaw that requires no attacker authentication but mandates victim UI interaction. The C:H metric signals high confidentiality impact; however, unchanged scope (S:U) bounds damage to the affected browser session. The EPSS score of 0.15% at the 5th percentile sharply contradicts the CVSS severity signal, indicating the broader security research community assigns very low near-term exploitation probability - this gap is explained by the UI:R constraint, which makes automated or mass exploitation impossible and requires per-victim social engineering. No CISA KEV listing and no identified public exploit code further reduce urgency. The UI:R prerequisite is operationally expensive for attackers, limiting realistic exploitation to targeted scenarios against specific individuals rather than opportunistic mass campaigns. This positions the CVE as standard patch-cycle priority rather than emergency response, though the zero-authentication network vector and C:H impact justify prompt patching over indefinite deferral.

An attacker crafts a malicious webpage and socially engineers a victim - for example via phishing, tech-support scam, or instructional lure - into opening Chrome DevTools on that page and performing a specific UI action such as clicking a menu item or navigating a panel. The missing authorization check in DevTools then allows the attacker-controlled page context to extract sensitive information from the browser session, such as cookies, network responses, or stored credentials visible in DevTools panels. No public exploit code has been identified, meaning exploitation currently requires manual, targeted effort per victim.