Google Chrome CVE-2026-79184

Exploitation requires two sequential conditions: (1) the attacker must have already achieved renderer process compromise through a separate vulnerability - this is not a default or trivially reached state; and (2) a user must visit a crafted HTML page (UI:R), providing the trigger for the Preload authorization bypass. No authentication is required for the final exploitation step (CVSS PR:N), but the renderer compromise prerequisite represents a high practical barrier. The vulnerability is limited to confidentiality impact (C:L) with no write or availability effect. Exploitation does not appear to require any non-default Chrome configuration - the Preload feature is active by default - but the renderer compromise gating condition means this cannot be exploited directly from the network against an uncompromised browser instance.

The CVSS 3.1 base score of 4.3 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N nominally suggests a straightforward, low-complexity network attack requiring only user interaction, but this framing substantially overstates accessibility: the description explicitly conditions exploitation on a prior renderer process compromise, a non-trivial prerequisite that makes the real-world attack chain considerably more complex than AC:L implies. EPSS at 0.22% (13th percentile) corroborates that exploitation is rare in practice. The CVE is not listed in the CISA KEV catalog, no public exploit code has been identified, and Chromium's own internal severity rating is Low. The web origin policy bypass yields only limited confidentiality impact with no integrity or availability consequence, further constraining the damage ceiling. Overall this is a low-urgency patch - important to apply as part of routine Chrome update cycles, but not a priority requiring emergency out-of-band response.

An attacker first compromises the Chrome renderer process through a separate, independent vulnerability, then serves the victim a crafted HTML page that triggers the missing authorization check in the Preload subsystem. The compromised renderer reads cross-origin data it should not be permitted to access, bypassing the Same-Origin Policy and potentially exposing session tokens or page content from other origins. No public exploit code has been identified for CVE-2026-79184 at time of analysis.