Google Chrome CVE-2026-79262

Exploitation requires that the victim use Google Chrome prior to version 152.0.7977.65 and actively visit a crafted HTML page under attacker control - the CVSS UI:R metric confirms this user-interaction prerequisite. Per PR:N in the CVSS vector, no authentication or account on the target system is required. The attack is delivered entirely over the network (AV:N) with low complexity (AC:L), meaning no race conditions or special configuration states are needed beyond the victim loading the page. Exploitation is limited by the requirement for user interaction (clicking a link or navigating to the attacker's URL) and the confined impact (confidentiality only, no integrity or availability effect). Non-Chrome browsers are not affected.

The CVSS 3.1 base score of 4.3 (Medium) reflects an accessible but impact-limited vulnerability: AV:N and AC:L mean no special network position is needed, but UI:R anchors exploitation to user interaction, and the impact is confined to C:L with no integrity or availability component. EPSS at 0.29% (21st percentile) is low, suggesting this class of Chrome origin-bypass has not attracted significant automated exploitation tooling. No KEV listing and no public POC code have been identified at time of analysis. The overall risk profile is consistent with a vulnerability that warrants patching on normal update cycles rather than emergency response - Chrome's auto-update mechanism mitigates exposure for most end users quickly. The primary real-world risk is targeted, socially-engineered phishing attacks rather than mass exploitation.

An attacker registers a malicious domain and hosts a crafted HTML page that exploits the incorrect network authorization logic in Chrome's origin enforcement. The attacker distributes a link via email or social media; when a victim running an unpatched Chrome version clicks the link and the page loads, the origin policy check is bypassed, potentially allowing the attacker's page to read limited cross-origin data from another site the victim is authenticated to.