Google Chrome CVE-2026-79231

The victim must actively open or be redirected to a crafted HTML page using Google Chrome prior to version 152.0.7977.65; user interaction (UI:R) is required - the browser will not trigger the vulnerability passively. The Media component must process attacker-controlled media content embedded in the page, which is a default-enabled browser capability and does not require non-default configuration. No authentication to the browser or any service is required (PR:N). Exploitation is bounded by Chrome's renderer sandbox (S:U), meaning code execution is confined to the renderer process and cannot directly access OS-level resources without a separate sandbox escape. The EPSS of 0.28% suggests exploitation at scale has not been observed, which may reflect the sandbox constraint raising the bar for meaningful post-exploitation.

The CVSS 8.8 High score is technically justified by network delivery, low complexity, no authentication, and high C/I/A impact within the renderer process. However, three signals moderate real-world prioritization: first, scope is unchanged (S:U), confirming impact is constrained to the Chrome sandbox rather than the host OS; second, EPSS at 0.28% (20th percentile) is low for a network-reachable, no-auth vulnerability, suggesting exploitation has not been observed at scale at the time of scoring; third, no CISA KEV listing exists, and the Chromium bug tracker entry (issues.chromium.org/issues/504356442) is the primary source - access and POC status are not confirmed from available data. The CVSS vector and the sandbox scope (S:U) are consistent with each other and with the description. There is no apparent conflict between data sources. The practical priority is standard browser patch deployment rather than emergency incident response, unless a sandbox escape companion vulnerability is later disclosed.

An attacker hosts a web page containing crafted media content (audio or video) designed to trigger a heap buffer overflow in Chrome's Media component during parsing or decoding. A victim using an unpatched Chrome version visits the page - through a phishing link, malicious advertisement, or compromised legitimate site - causing arbitrary code to execute within Chrome's renderer sandbox. From the sandbox, the attacker has access to the victim's browsing context and could chain a sandbox escape vulnerability for host-level access, though no such companion exploit is indicated in the current data.