Google Chrome CVE-2026-79215

The user must actively visit an attacker-controlled or attacker-compromised webpage containing malicious WebGL content (UI:R per CVSS vector) - exploitation cannot occur without this interaction. No authentication to any service is required from the attacker's perspective (PR:N). WebGL must be enabled in Chrome, which is the default and non-configurable by end users in standard installations. Exploitation is limited to Chrome desktop versions prior to 152.0.7977.65; updated installations are not affected. The use of 'potentially' in the description regarding sandbox escape indicates that code execution within the renderer sandbox may be more reliably achievable than a full sandbox breakout, and additional exploit chaining may be required for the latter. Non-default enterprise configurations that disable WebGL (Disable3DAPIs policy) would block this attack vector entirely.

The CVSS 8.8 base score reflects a network-reachable, low-complexity attack requiring only user interaction (UI:R), with high confidentiality, integrity, and availability impact - a strong signal on paper. However, several signals moderate the real-world priority: EPSS is 0.25% at the 16th percentile, meaning exploitation is observed or predicted less frequently than 84% of CVEs in the database. No POC is publicly available and the vulnerability is not listed in CISA KEV. Notably, Chromium's internal severity rating is 'Medium' despite the 8.8 NVD score, which often indicates the Chromium security team assessed exploitation difficulty as higher than CVSS vectors alone suggest - integer overflows in GPU codepaths frequently require precise heap grooming to reliably weaponize. The CVSS vector's S:U (scope unchanged) is in mild tension with the description's 'outside the sandbox' language; this ambiguity is unresolved and should be monitored via the Chromium issue tracker (issues.chromium.org/issues/513760788). Overall: elevated on severity but lower on realistic near-term exploitation probability; patch as standard cadence unless high-value targets warrant expedited deployment.

An attacker crafts a malicious HTML page containing WebGL shader or buffer operations designed to trigger the integer overflow with a precisely controlled input size. When a targeted user is socially engineered or redirected to visit the page - via phishing email, malicious ad, or compromised website - Chrome's WebGL subsystem processes the crafted data, the integer wraps, and the resulting memory corruption provides a primitive that could be leveraged for arbitrary code execution within or potentially outside the renderer sandbox. No public POC is available, so reliable exploitation likely requires significant additional research and heap-layout manipulation.