Google Chrome CVE-2026-79276

Exploitation requires the victim to be running Google Chrome on any platform at a version prior to 152.0.7977.65. The attacker must successfully socially engineer the victim into visiting a crafted HTML page - this mandatory user interaction (UI:R in the CVSS vector) is the primary limiting factor and rules out fully automated, wormable exploitation. No authentication or special privileges are required on the attacker's side (PR:N). Exploitation is bounded to integrity impact only (I:L); the flaw cannot be used to read sensitive data (C:N) or crash the system (A:N). The unchanged scope (S:U) means this vulnerability alone cannot pivot into other system components outside the browser's existing privilege boundary.

Real-world risk is low despite the network-accessible attack vector. The CVSS 4.3 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) requires mandatory user interaction via social engineering - a meaningful exploitation barrier that prevents opportunistic mass targeting. The EPSS score of 0.23% at the 13th percentile independently confirms low observed exploitation interest across the threat intelligence community. The vulnerability is absent from the CISA KEV catalog, and no public exploit code has been identified, making escalation beyond targeted phishing campaigns unlikely in the near term. The damage ceiling is also constrained: impact is integrity-only at the Low level (C:N, A:N), so attackers cannot exfiltrate data or disrupt availability through this flaw alone. Priority for most organizations should be routine: apply the Chrome 152.0.7977.65 update during normal browser patching cycles without emergency escalation.

An attacker constructs a malicious HTML page embedding logic that abuses the FileSystem privilege management flaw, then delivers a link to it via phishing email or a compromised website. When a target running an unpatched Chrome version visits the page, the crafted content triggers the privilege boundary bypass, granting the attacker limited unauthorized write or access operations against local filesystem paths within the browser's privilege context. No public exploit code exists at time of analysis, but the delivery mechanism - a link in a phishing message - is realistic and requires only that the user clicks through.