Google Chrome CVE-2026-79259

Exploitation requires that the target user interact with a crafted file - per the CVSS UI:R metric, user interaction is mandatory and the attack cannot succeed without the victim opening or processing the malicious file in Chrome. Chrome's Safebrowsing feature must be active, though it is enabled by default in all standard installations, so no special non-default configuration is required. The attack is network-accessible (AV:N) and requires no authentication from the attacker (PR:N), meaning delivery can occur entirely remotely. The critical limiting factor is user interaction: the victim must take action on the crafted file, which prevents fully automated or worm-style exploitation and significantly reduces opportunistic mass-exploitation risk. Exploitation is further limited to Chrome versions prior to 152.0.7977.65.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) places this as a moderate, network-reachable issue with low attack complexity but a mandatory user interaction gate (UI:R), which substantially reduces its mass-exploitation potential. Impact is confined to integrity at a limited level - no confidentiality or availability effects are present. The EPSS score of 0.22% at the 12th percentile signals that exploitation is statistically unlikely relative to the broader CVE population, and there is no CISA KEV listing and no public exploit identified at time of analysis. The intelligence tags label this an 'Authentication Bypass,' but the described mechanism is a Safebrowsing access restriction bypass via crafted file input - not a credential authentication bypass; this distinction is not independently verified by vendor advisory language. Overall, this is a real but low-priority issue: the required user interaction, absence of confidentiality or availability impact, and low EPSS collectively suggest this is not a frontline remediation target beyond routine patching cadence.

An attacker crafts a malicious file designed to exploit the Safebrowsing input validation flaw and delivers it to a target via a phishing email, malicious web page, or file-sharing link. When the victim opens the crafted file in an unpatched version of Chrome, the Safebrowsing component processes it without adequate validation, allowing the attacker to bypass access restriction checks that would otherwise flag or block the content. No public exploit code has been identified at time of analysis, limiting this scenario to targeted or researcher-driven attempts rather than commodity exploitation.