Google Chrome CVE-2026-79244

Exploitation requires a user to be running Google Chrome prior to 152.0.7977.65 and to actively navigate to an attacker-controlled or compromised webpage that delivers the malicious Animation payload. The CVSS UI:R metric confirms that user interaction is mandatory - the victim must open the crafted page; passive or drive-by exploitation without any user action is not possible. No authentication or prior account compromise is required from the attacker's perspective (PR:N). The impact is bounded to Chrome's renderer sandbox: an attacker cannot directly interact with the host operating system without a separate sandbox escape primitive. SSVC's 'Automatable: no' designation indicates that chaining this into a reliable, automated mass-exploitation pipeline is not straightforward. Exploitation is further limited to the specific vulnerable Chrome version range on any platform where Chrome is installed.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects broad remote exploitability with no authentication barrier, requiring only that a user visit a crafted webpage. However, multiple signals moderate the real-world urgency below what the raw score implies: Chromium's internal severity classification is Low, SSVC designates exploitation status as 'none' and automatable as 'no,' and the impact is explicitly sandboxed to the renderer process. The divergence between NVD's 8.8 HIGH and Google's Low internal rating is a material signal - the NVD score captures the theoretical code-execution impact ceiling, while Chromium's rating weights the sandbox containment and the absence of a direct OS-level compromise path. No EPSS score was provided in the source intelligence, so exploitation probability cannot be quantified numerically. CISA KEV status is not confirmed. Chrome's fast auto-update cadence means the vulnerable population shrinks rapidly after a stable channel release, further reducing the practical exploitation window. Overall, this warrants prompt patch verification rather than emergency response.

An attacker publishes or compromises a webpage containing a specially constructed HTML payload that triggers the use-after-free condition in Chrome's Animation component during rendering. When a target user opens the page in a vulnerable Chrome version - via phishing email, malicious advertisement, or a compromised trusted site - the freed memory object is accessed, corrupting heap state in the renderer process and enabling arbitrary code execution within the Chrome sandbox. No public proof-of-concept code has been identified at time of analysis; achieving impact beyond the sandbox would require a separate, chained sandbox escape primitive.