Google Chrome CVE-2026-79258

Exploitation requires the victim to be running Google Chrome at a version prior to 152.0.7977.65 and to actively navigate to an attacker-controlled HTML page - passive drive-by exploitation without user interaction is not possible per the UI:R CVSS metric. The attacker must successfully execute a social engineering step (phishing, malicious advertisement, deceptive link) to direct the victim to the crafted page. No non-default browser configuration or special server-side setup is required on the victim's side; default Chrome installations running any version below the fix threshold are vulnerable. Exploitation is additionally bounded by the fact that exfiltrated data is limited to cross-origin content reachable within the victim's active browser session - the attacker cannot access arbitrary system data, and there is no integrity or availability impact.

The CVSS 6.5 vector is network-accessible with low attack complexity and no privilege requirement, but the mandatory user-interaction (UI:R) metric introduces meaningful friction that separates this from fully passive network exploitation. EPSS at 0.21% (11th percentile) is low, consistent with no weaponized exploit in circulation and no CISA KEV listing; the high confidentiality impact (C:H) metric elevates the base score but does not reflect currently observed exploitation rates. The social engineering prerequisite means opportunistic, automated mass exploitation is not viable - a targeted phishing campaign remains the realistic threat model. Given Chrome's ubiquitous deployment footprint and the sensitivity of cross-origin data a logged-in browser session may reach, patching should be treated as a routine but prompt update cycle rather than an emergency zero-day response. No conflicting signals exist between CVSS and EPSS data; both consistently indicate moderate theoretical severity with low current exploitation probability.

An attacker crafts an HTML page that triggers the WebXR authorization flaw to read data from a cross-origin context accessible to the victim's browser session - such as authenticated content on a site the victim is already logged into. The attacker delivers the link via phishing or a deceptive social media post, convincing the victim to click through and load the page in an unpatched Chrome instance. Upon page load and minimal user interaction within the WebXR context, cross-origin data is silently exfiltrated to attacker-controlled infrastructure; no public exploit code has been identified at time of analysis.