Google Chrome CVE-2026-79270

Exploitation requires a user running Google Chrome prior to version 152.0.7977.65 to visit an attacker-controlled or attacker-influenced HTML page - user interaction is mandatory (confirmed by UI:R in the CVSS vector). The attack is network-accessible and requires no authentication (PR:N), meaning no credentials or session tokens are needed, but the victim must actively navigate to the malicious content. The vulnerability is triggered through normal graphics rendering via the ANGLE subsystem; no special Chrome configuration, non-default flags, or specific extensions are required beyond a standard Chrome installation. Exploitation is meaningfully limited by: (1) the user-interaction requirement preventing passive or drive-by exploitation without some social engineering vector; (2) the read-only impact - no code execution or integrity modification, limiting the flaw to information disclosure without a chained exploit; and (3) the availability of an automatic vendor patch that most up-to-date Chrome deployments will have already received.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N characterizes this as a remotely triggerable, low-complexity information disclosure requiring only that a user visit a crafted page. Despite the High confidentiality impact rating, EPSS stands at just 0.29% (21st percentile), indicating that exploitation has not been widely observed and no weaponized code is circulating at this time. The vulnerability is absent from CISA KEV, and no POC has been identified from available data. The Unchanged scope (S:U) is notable: while memory outside the sandbox is readable, this does not constitute a full sandbox escape - lateral movement or code execution would require chaining with additional exploits. The gap between the High CVSS confidentiality score and the low EPSS percentile suggests this flaw is theoretically impactful but practically difficult to exploit reliably without additional primitives. The user-interaction requirement (UI:R) further limits opportunistic mass exploitation, constraining realistic risk to targeted or phishing-assisted scenarios. Patch availability from Google substantially reduces residual risk for organizations with timely update posture.

An attacker hosts a malicious HTML page containing crafted WebGL or graphics-intensive content designed to trigger an uninitialized resource allocation within Chrome's ANGLE layer. When a victim with a vulnerable Chrome version navigates to the page - for example, via a phishing link or a compromised advertisement - the browser processes the graphics payload, reads uninitialized memory from outside the renderer sandbox, and potentially exposes sensitive process memory contents to the attacker via a side channel or direct data exfiltration path. No public exploit or POC code has been identified at time of analysis.