Google Chrome Android CVE-2026-79256

Exploitation requires two sequential, mandatory prerequisites: first, the attacker must have already achieved code execution within Chrome's renderer process on the target Android device via a separate, independent vulnerability - this is explicitly stated in the CVE description and is the primary limiting factor. Second, the victim must actively interact with a crafted HTML page (UI:R), meaning fully passive exploitation is not possible. The vulnerability is constrained to Chrome on Android and its WebView component; desktop Chrome platforms are not indicated as affected. The CVSS PR:N reflects the network attacker's perspective for the delivery of the HTML page, but the effective exploitation bar is substantially higher due to the renderer-compromise prerequisite. Exploitation is not feasible without a companion renderer exploit, which restricts this vulnerability to sophisticated threat actors capable of chaining multiple browser exploits.

The CVSS 8.3 High score is driven by full C/I/A impact and a scope change (S:C) reflecting OS-level code execution outside the Chrome sandbox, but AC:H and UI:R significantly constrain real-world exploitability. Most critically, the CVE description explicitly states that the renderer process must already be compromised - making this a second-stage exploit that is only viable when chained with a separate renderer vulnerability, a capability that lies well beyond commodity attacker toolkits. EPSS at 0.33% (25th percentile) is independently low, no CISA KEV listing exists, and no POC has been publicly identified. The Chromium team's internal 'Medium' severity classification aligns with this chained-exploit dependency despite the high CVSS. The CVSS vector is internally consistent with the description: AV:N and PR:N reflect the network-delivered HTML page, while AC:H captures the renderer-compromise prerequisite. Overall, this is a genuine vulnerability warranting timely patching on managed Android fleets but does not justify emergency response absent evidence of active exploitation.

An attacker first exploits a separate, unrelated Chrome renderer vulnerability to gain arbitrary code execution within the sandboxed renderer process on the victim's Android device, then delivers or causes the renderer to process a crafted HTML page that triggers the CWE-610 externally controlled reference flaw in WebView, which causes the browser or OS process to resolve an attacker-controlled reference in a higher-privilege context, achieving code execution outside the sandbox. No public exploit code for this specific vulnerability has been identified at time of analysis.