Google Chrome CVE-2026-79263

The target must be running Google Chrome prior to version 152.0.7977.65 with the Extensions component active (i.e., at least one extension installed or the extensions framework enabled, which is the default state). Exploitation is delivered via crafted network traffic requiring no authentication and no user interaction, but attack complexity is High (AC:H) because the attacker must win a race condition with precise timing - SSVC confirms this is not automatable, ruling out opportunistic mass exploitation. Exploitation is further bounded by the sandbox: successful code execution is confined to Chrome's sandboxed process and does not directly yield OS-level or kernel access. Non-default configurations or specific extension types required to trigger the race are not specified in available data.

The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly encodes network accessibility and full CIA impact within scope, but the AC:H and S:U are the critical limiting factors. AC:H reflects the inherent timing difficulty of reliably winning a race condition, which SSVC independently confirms as Automatable: no - mass exploitation is not feasible. S:U (scope unchanged) captures that no sandbox escape occurs, meaning impact is bounded to the Chrome process environment. Chromium's own Low rating aligns with this: sandbox-level RCE is meaningfully less severe than OS-level RCE. SSVC Exploitation: none and the absence of a CISA KEV listing reinforce that this has not been observed in active campaigns. The net picture is a technically credible but hard-to-exploit vulnerability with real-but-bounded impact, requiring prioritization only for environments where browser-layer credential or session compromise is a significant threat model.

An attacker serves or injects specially crafted network traffic - for example via a malicious website, a compromised CDN response, or a man-in-the-middle position - timed to trigger a race condition in Chrome's Extensions component while it processes network events. If the attacker successfully wins the timing race within the TOCTOU window, they achieve arbitrary code execution within the Chrome sandbox, potentially accessing browser-stored credentials, session cookies, and extension data. No public exploit code exists at time of analysis, and the race condition timing requirement makes reliable, repeatable exploitation technically demanding.