Google Chrome Android CVE-2026-79225

Exploitation requires that the victim be running Chrome for Android (not Chrome on any desktop platform or iOS) on a version prior to 152.0.7977.65. The attacker must successfully social engineer the victim into performing a specific UI interaction - a tap, approval, or dialog confirmation - within the browser context; passive page load is insufficient. The CVSS vector (UI:R) confirms this interaction is mandatory and cannot be bypassed remotely without it. Exploitation is constrained to a limited integrity bypass (I:L) with no ability to read sensitive data (C:N) or disrupt service (A:N). Exploitation is further limited to the unchanged scope of the Chrome application sandbox (S:U), meaning OS-level privilege escalation or cross-app compromise is not achievable through this vulnerability alone.

Aggregate risk signals consistently point to low real-world priority. CVSS 4.3 (Medium) is the highest signal here, driven by the network attack vector and no authentication requirement, but the impact triad (C:N/I:L/A:N) substantially limits the score. EPSS of 0.17% at the 7th percentile indicates very few comparable vulnerabilities at this score level have been actively exploited in the wild. No KEV listing and no known POC further reduce urgency. Chromium's own assessment is 'Low' severity, which aligns with the constrained impact: an attacker can only achieve a limited bypass of system access restrictions with no data disclosure or service disruption. The UI:R requirement means opportunistic mass exploitation is impractical - each target must be individually social engineered. The Android-only platform restriction further narrows the exposed population to Chrome mobile users. This vulnerability is a legitimate patch priority during routine update cycles but does not warrant emergency response.

An attacker crafts a malicious web page or deep-link and distributes it via phishing message, QR code, or third-party app to an Android Chrome user. Upon visiting the page, the victim is presented with a deceptive UI element - such as a spoofed system dialog or misleading button - that, when tapped, triggers the incorrect authorization logic and bypasses a system access restriction, allowing the attacker to perform a limited write or modify action not normally permitted. No public exploit code has been identified at time of analysis.