Google Chrome CVE-2026-79177

Exploitation requires two chained conditions: (1) the attacker must already have achieved code execution within Chrome's renderer process via a separate, unrelated vulnerability - this is a non-trivial prerequisite that substantially limits the exploitable population; (2) the victim must be running Chrome on Windows (not macOS, Linux, Android, or iOS), specifically a version prior to 152.0.7977.65. User interaction is required in the form of visiting a crafted HTML page (CVSS UI:R). No authentication to the target system is needed once renderer compromise is achieved. The limitation of this flaw to Windows-specific Media code paths and its dependency on a prior renderer exploit significantly narrows real-world applicability compared to what the raw CVSS score implies.

The NVD CVSS score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) warrants scrutiny. The PR:N rating implies no prior privileges, but the description explicitly requires a compromised renderer process - a significant prerequisite that the provided vector does not reflect, creating a material inconsistency. Chromium's own severity rating of 'Low' better captures the real-world difficulty: this flaw is only useful after an attacker has already exploited a separate renderer vulnerability, making it a second-stage sandbox escape rather than a standalone attack. EPSS at 0.21% (11th percentile) confirms low exploitation probability at present. No KEV listing means active exploitation is not confirmed. Real-world priority should be moderate: patch promptly as part of normal browser update cycles but not an emergency response - unless your threat model includes sophisticated multi-exploit browser chains.

An attacker crafts a malicious HTML page that first exploits a separate renderer vulnerability to gain code execution within Chrome's sandboxed renderer process on a Windows host; once inside the renderer, the attacker leverages this Media authorization bypass to issue privileged calls that cross the sandbox boundary and access Windows system resources. No public proof-of-concept code has been identified at time of analysis, but the two-stage chain is a well-understood class of browser exploitation.