Google Chrome CVE-2026-79232

Exploitation requires the victim to load attacker-controlled web content (UI:R) - a crafted HTML page opened in a vulnerable Chrome build prior to 152.0.7977.65; there is no authentication requirement (PR:N) and no special server-side configuration. The limiting factors are user interaction (the target must navigate to or render the malicious page) and version (only builds below 152.0.7977.65 are affected across Windows, macOS, and Linux). Full sandbox-escape code execution as described may in practice depend on additional heap-grooming reliability and could be chained with a separate renderer exploit, but the CVE itself scopes the condition to viewing a malicious page.

The signals are mixed and should be weighed rather than read off the headline score. CVSS 9.6 is driven by network reach, low complexity, no privileges, a scope change (sandbox escape), and high CIA impact - but the vector requires user interaction (UI:R), meaning a victim must open a malicious page, which meaningfully lowers real-world automatability. This aligns with CISA SSVC, which rates Automatable: no and Exploitation: none while confirming Technical Impact: total. EPSS is low at 0.33% (25th percentile), consistent with no known public exploit and no KEV listing, suggesting there is no observed active or widespread exploitation yet. That said, browser sandbox escapes are high-value targets historically chained with a renderer bug for full compromise, so the total technical impact keeps this a patch-soon priority for any organization running Chrome at scale; given Chrome's ubiquity, defenders should treat rollout of 152.0.7977.65 as urgent even though current exploitation evidence is absent. In short: genuinely high impact, currently low observed exploitation probability - prioritize by exposure, not by the raw 9.6 alone.

An attacker hosts a crafted HTML page (or serves it via a malvertising/compromised-site vector) and lures a victim into visiting it; the page triggers the Aura use-after-free, corrupting browser-process memory to attempt code execution outside the renderer sandbox. Low attack complexity means no special timing or environment is needed once the page is loaded, but the attack depends on the victim opening the link. No public proof-of-concept is identified at time of analysis.