Chrome WebView CVE-2026-79273

Exploitation requires that the victim is using Google Chrome on an Android device running a version prior to 152.0.7977.65. The CVSS vector UI:R confirms that the victim must actively navigate to or open a crafted HTML page - passive drive-by exploitation without user interaction is not possible under this vector. PR:N confirms no authentication to the attacker's infrastructure is needed. AC:L indicates no race condition or complex state is required. Exploitation is limited to the Android platform; Chrome on Windows, macOS, Linux, iOS, and ChromeOS is not in scope per the CVE description. The impact is bounded to partial confidentiality leakage (C:L); there is no integrity or availability impact, limiting the practical utility of the bypass to information theft rather than account takeover or code execution.

Real-world risk is low-to-moderate. The CVSS 4.3 score is driven by the network attack vector (AV:N), low complexity (AC:L), and no privilege requirement (PR:N), but is tempered significantly by the required user interaction (UI:R) and scope-unchanged, confidentiality-limited impact (S:U/C:L/I:N/A:N). Chromium's own engineers rated this Low severity internally, which is consistent with the narrow impact. The EPSS score of 0.20% at the 10th percentile indicates that exploitation is highly unlikely in the near term relative to other CVEs in the corpus. No CISA KEV listing and no public exploit code exist at time of analysis. The 'Authentication Bypass' tag in the source data is a loose label - the actual bypass is of the web origin policy, not a login mechanism; these should not be conflated. The primary real-world risk is targeted leakage of cross-origin data in a scenario where an attacker can lure an Android Chrome user to a malicious page, but the attacker gains only limited read access and no write or availability impact.

An attacker hosts a crafted HTML page that exploits the incorrect reference resolution flaw in Chrome's WebView on Android. A victim running an unpatched version of Chrome (or an app embedding WebView) visits or is redirected to that page - for example, via a phishing link - and the WebView resolves a cross-origin reference incorrectly, allowing the attacker's page to read a limited amount of data from a different web origin. No public exploit code exists at time of analysis, and the low EPSS score suggests this scenario remains largely theoretical.