Google Chrome CVE-2026-79264

The attack requires a victim user to actively navigate to or load an attacker-controlled HTML page - confirmed by the CVSS UI:R metric. The page must contain specially crafted Preload resource hints designed to trigger the incorrect reference resolution. No authentication is required on the attacker's side (PR:N), and no non-default Chrome configuration is needed; the Preload feature is enabled by default in all Chrome releases. Exploitation is limited by the mandatory user interaction (the victim must visit the page), the low confidentiality impact ceiling (C:L - only a constrained subset of cross-origin data is accessible), and the absence of integrity or availability impact. The scope is unchanged (S:U), confining the effect to the browser's rendering context with no lateral pivot to the underlying OS or other applications.

The CVSS 3.1 base score of 4.3 (Medium) accurately captures the limited blast radius: the attack requires user interaction (UI:R), yields only low confidentiality impact (C:L), and has no integrity or availability dimension. The EPSS score of 0.31% at the 23rd percentile is consistent with a medium-severity browser bug that has not drawn attacker automation or commodity exploit tooling. There is no CISA KEV listing and no public POC code, making this a standard patch-cycle priority rather than an emergency response item - even a small IT team managing a modest fleet should be able to address this through routine Chrome update deployment rather than emergency out-of-band patching. The absence of both KEV and meaningful EPSS signal suggests exploitation, if any, would be targeted and opportunistic rather than widespread.

An attacker hosts a crafted HTML page containing malicious Preload directives that trigger the incorrect reference resolution. When a victim user visits or is redirected to this page - via phishing link, malvertising, or injected iframe on a compromised site - Chrome's Preload subsystem resolves a cross-origin reference as same-origin. The attacker's script then reads a limited subset of data from the incorrectly resolved resource, bypassing the SOP boundary. No public exploit code has been identified at time of analysis.