Google Chrome CVE-2026-79218

Exploitation requires the victim to actively visit a crafted HTML page in a vulnerable version of Chrome (any version prior to 152.0.7977.65), satisfying the UI:R requirement. The attacker must additionally have achieved renderer process compromise as a prerequisite - either via a separate renderer vulnerability in the same page load or as part of a staged exploit chain - before the incorrect authorization flaw can be triggered for sandbox escape. High attack complexity (AC:H) reflects this chained prerequisite. No authentication to the target system is required (PR:N), but the renderer compromise barrier is a substantial real-world constraint. Exploitation is limited to desktop Chrome; mobile Chrome and Chromium-based browsers may require separate assessment. Users running Chrome 152.0.7977.65 or later are fully protected. Environments enforcing strict URL filtering, JavaScript controls, or content security policies reduce exposure at the initial renderer compromise stage.

The CVSS 3.1 base score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects the potential for full system compromise with scope change, but the AC:H and UI:R metrics indicate meaningful exploitation friction: the attacker must both socially engineer a page visit and first achieve renderer compromise. EPSS corroborates this friction, placing exploitation probability at only 0.24% at the 15th percentile - substantially below the threshold typically associated with active exploitation campaigns. No CISA KEV listing and no confirmed public exploit code further support treating this as a priority-but-not-emergency item for most organizations. However, the S:C/C:H/I:H/A:H impact - complete sandbox escape yielding full OS-level code execution - means the downstream consequence of a successful chain is severe. Chrome's ubiquitous deployment footprint amplifies aggregate risk: independent renderer exploit bugs exist continuously in the wild and could serve as the prerequisite stage for this escape. No conflicting signals were identified between the CVSS vector, description, and EPSS data.

An attacker hosts a crafted HTML page that first triggers a renderer process vulnerability to achieve renderer compromise, then leverages the incorrect sandbox authorization flaw in CVE-2026-79218 to escape Chrome's sandbox and execute code in the context of the logged-in OS user. The victim must visit the malicious page (UI:R), at which point the two-stage chain - renderer compromise followed by sandbox escape - executes silently. No public exploit code for this specific CVE has been identified at time of analysis.