Google Chrome CVE-2026-79226

Exploitation requires the target user to install or activate a specially crafted Chrome extension, which the attacker delivers through social engineering (UI:R per CVSS). The victim must be running Google Chrome prior to version 152.0.7977.65 on a desktop system. No authentication to Chrome or any remote service is required from the attacker's perspective (PR:N), and no special non-default Chrome configuration is needed - the Regional Capabilities component is present in standard Chrome builds. The primary limiting factor is the mandatory user interaction: the victim must be successfully socially engineered into installing the malicious extension. Enterprise environments with extension installation restricted via Chrome policy are not exploitable through this vector, as the crafted extension cannot be installed.

The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H places this in the High severity band, driven by high confidentiality, integrity, and availability impact. However, several signals substantially reduce the urgency compared to raw score alone: EPSS probability is 0.21% at the 11th percentile, indicating very low observed or modeled exploitation pressure; there is no CISA KEV listing; and no public exploit code has been identified. The UI:R metric is significant - exploitation requires active social engineering to induce a user to install or interact with a malicious Chrome extension, which introduces a meaningful friction point. The SSVC exploitation status is 'none' based on available signals, the attack is potentially automatable at scale via phishing campaigns, and the technical impact is total given the C:H/I:H/A:H ratings. In practice, this vulnerability affects one of the most ubiquitously deployed applications in existence, meaning the aggregate exposure surface is enormous even if per-instance exploitation probability is low - a mid-sized enterprise with hundreds of Chrome desktops faces meaningful aggregate risk if a targeted phishing campaign is launched. The divergence between high CVSS and low EPSS likely reflects that user-interaction-dependent browser extension attacks, while impactful, require social engineering effort that limits opportunistic mass exploitation.

An attacker crafts a Chrome extension that exploits the Regional Capabilities privilege management flaw and distributes it through a phishing campaign - for example, a fake enterprise IT communication instructing users to install a 'required security update' extension via a link. Once the user installs the extension, it triggers the improper privilege escalation, allowing the extension to bypass system access restrictions and potentially access data or functionality outside its declared permissions. No public exploit code has been identified, but the attack mechanism is conceptually straightforward given the social engineering delivery vector.