Google Chrome CVE-2026-79202

The victim must visit an attacker-controlled or compromised webpage using Google Chrome prior to version 152.0.7977.65, confirming the UI:R (user interaction required) designation in the CVSS vector. No attacker-side authentication or special privileges are required (PR:N). Exploitation is constrained to Chrome's renderer sandbox per the CVE description ('execute arbitrary code inside the sandbox'), meaning host-level impact requires chaining with a separate sandbox escape exploit not described here. The Chromecast component's involvement may imply the Cast feature must be present (it is enabled by default in Chrome), but the description does not explicitly state a non-default configuration is required. Exploitation is not automatable per SSVC, meaning drive-by mass compromise campaigns are not straightforwardly achievable.

The CVSS 8.8 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that no attacker-side privileges or complex preconditions are needed, but user interaction is required. Cross-referencing against other intelligence signals reveals a more nuanced picture: EPSS stands at only 0.41% (34th percentile), indicating that observed exploitation probability in the wild remains very low at this time. SSVC independently classifies exploitation as 'none' and automatable as 'no,' meaning mass exploitation campaigns are not currently expected. The absence of a CISA KEV listing further corroborates no confirmed active exploitation. The SSVC 'total technical impact' rating aligns with the High C/I/A CVSS metrics but must be interpreted in the context of sandbox confinement stated in the CVE description - actual host-level impact requires a follow-on sandbox escape not evidenced here. Taken together, the real-world urgency is lower than the raw CVSS score alone suggests, though the zero-privilege network-accessible attack vector means the patch should still be applied promptly as a matter of routine hygiene.

An attacker hosts a crafted HTML page designed to trigger the use-after-free condition in Chrome's Chromecast component. A victim browsing to that page with an unpatched Chrome instance causes memory corruption in the renderer process, granting the attacker code execution within Chrome's sandbox. No public proof-of-concept exploit has been identified at time of analysis, limiting current opportunistic exploitation.