Google Chrome CVE-2026-79254

Exploitation requires the victim to be running Google Chrome on Android (not desktop) at a version prior to 152.0.7977.65, and the attack surface is specifically the CustomTabs component - meaning the crafted page must be opened through a CustomTab context (common in third-party apps that embed web views via Chrome CustomTabs) or directly in Chrome. Per the CVSS vector (UI:R), the victim must actively navigate to or open the crafted HTML page; passive drive-by exploitation without interaction is not possible. The scope is unchanged (S:U), confining impact to Chrome's own security boundary. SSVC confirms the attack is not automatable. No authentication is required from the attacker's side (PR:N), but the victim must be on an unpatched Android Chrome install.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) scores 4.3 (Medium), reflecting network delivery, low attack complexity, no required privileges, but mandatory user interaction and only limited integrity impact with no confidentiality or availability consequence. EPSS at 0.20% (10th percentile) indicates very low near-term exploitation probability - consistent with SSVC's confirmation that exploitation is currently 'none' and that the flaw is not automatable. No KEV listing exists, and no public POC has been identified, making this a lower-priority item on most security teams' queues. The 'Authentication Bypass' tag aligns with the access restriction bypass described, but the limited scope (S:U) constrains blast radius to the Chrome browser boundary. The primary signal gap is the broad CPE string, which does not filter by Android platform; affected scope is inferred from the description rather than confirmed by a platform-specific CPE entry.

An attacker crafts a malicious HTML page and delivers its URL through a third-party Android application that uses Chrome CustomTabs to render web content - such as a social, shopping, or news app. When the victim taps the link, Chrome opens the page in a CustomTab; the page triggers the incorrect reference resolution flaw to bypass Android system access restrictions and gain limited unauthorized access to resources beyond normal web content boundaries. No public POC exists at time of analysis.