Google Chrome CVE-2026-79282

Exploitation requires the victim to load an attacker-controlled or attacker-injected HTML page in Chrome for Android before version 152.0.7977.65 - user interaction (visiting/rendering the page) is mandatory per CVSS UI:R. The malicious page must exercise the vulnerable ANGLE graphics path (WebGL/graphics rendering) to trigger the use-after-free. Per CVSS PR:N the attacker needs no authentication and no prior privileges on the device. Limiting factors: the flaw is specific to the Android build and to Chrome versions below the fixed release, exploitation is not automatable per SSVC (each victim must be individually lured), and disabling WebGL removes the primary trigger surface.

The signals here are mixed and worth weighing carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) is severe: network reachable, low complexity, no privileges, a scope change reflecting the sandbox escape, and total confidentiality/integrity/availability impact - capped only by required user interaction (visiting a page). SSVC, however, reports Exploitation: none and Automatable: no, while Technical Impact is total; and EPSS is low at 0.35% (28th percentile). CISA KEV does not list this CVE, so there is no confirmed active exploitation. The reconciliation is that this is a high-severity, high-impact bug whose real-world exploitation is currently unproven and not trivially automatable (a victim must be induced to load a malicious page), which is why EPSS remains modest despite the 9.6 base score. Given the ubiquity of Chrome and the total technical impact of a sandbox escape, patching should still be prioritized even though there is no evidence of exploitation yet - any organization running mobile Chrome should treat the update as urgent rather than routine.

An attacker hosts or injects a crafted HTML page containing malicious WebGL/graphics content and entices an Android user to open it via phishing link, malvertising, or a compromised site. Loading the page triggers the ANGLE use-after-free, corrupting memory to achieve code execution that escapes the browser sandbox. No public exploit has been identified at time of analysis, and success requires the victim to actually visit the page (UI:R).