Google Chrome CVE-2026-79260

Exploitation requires two distinct preconditions: first, the attacker must have already achieved code execution within a Chrome renderer process through a separate, independent vulnerability - this is a non-trivial prerequisite that substantially limits the exploitable population. Second, the victim user must interact with a crafted HTML page, satisfying the UI:R requirement from the CVSS vector. What limits exploitation further: the renderer-compromise requirement means this cannot be used as an initial-access vector; it functions only as a privilege-escalation or boundary-escape component within a multi-stage attack chain. Standard Chrome sandbox and Site Isolation protections must also be absent or bypassed before cookie origin policy enforcement can be reached. Chromium's own internal severity rating of 'Low' reflects this constrained exploitation path.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) overstates standalone exploitability because the NVD vector does not encode the critical prerequisite: the attacker must have already compromised the renderer process, which typically requires a separate, independent exploit. This prerequisite sharply elevates real-world attack complexity beyond what AC:L implies. SSVC assessment corroborates this - Exploitation: none, Automatable: no, Technical Impact: partial - which together indicate this is not a fire-drill priority. EPSS at 0.18% (8th percentile) confirms low observed exploitation activity in the wild. The confidentiality impact is genuinely high if the full chain is assembled (cross-origin cookie theft), but assembling that chain requires two distinct vulnerabilities to be exploited in sequence. No public exploit code exists and this is absent from the CISA KEV catalog. Chromium's own severity rating of 'Low' aligns with the chained-exploit framing. The net assessment is: monitor for patch application but do not treat this as an emergency in the absence of a known renderer-compromise campaign.

An attacker who has separately exploited a memory-corruption or logic bug in Chrome's renderer process (for example, via a malicious or attacker-controlled web page) uses this cookie validation flaw as a second stage: the compromised renderer submits a crafted HTML page containing malformed cookie data to exfiltrate session cookies or authentication tokens belonging to a different origin, bypassing SOP. No public proof-of-concept code for this specific CVE has been identified at time of analysis, making opportunistic exploitation unlikely without the renderer-compromise prerequisite.