Google Chrome CVE-2026-79283

The victim must visit an attacker-controlled or attacker-compromised webpage using an unpatched version of Google Chrome (below 152.0.7977.65) on a supported desktop platform. CVSS PR:N confirms no authentication or account privileges are required on the attacker's side. CVSS UI:R confirms the victim must perform an interaction - at minimum, loading the page in the browser. No special Chrome configuration or feature flag is documented as a prerequisite. Exploitation is limited to Chrome desktop; mobile Chrome variants are not confirmed in scope. Attackers cannot exploit this vulnerability without delivering the crafted page to the target (e.g., via phishing link, malvertising, or compromised site). The spoofing impact is bounded to UI deception; arbitrary code execution is not within scope of this vulnerability class.

The CVSS 5.4 score reflects a network-reachable, low-complexity attack requiring user interaction (UI:R) with low confidentiality and availability impact and no integrity impact. The EPSS score of 0.17% (7th percentile) is very low, indicating the broader research community does not assess mass exploitation as imminent. There is no CISA KEV listing, and no public exploit code has been identified at time of analysis. The combination of low EPSS and absent KEV suggests this vulnerability is a theoretical or targeted threat rather than an active mass-exploitation target. However, the UI:R requirement is easily satisfied - any user who visits a malicious or compromised webpage meets it - lowering the practical bar for targeted social-engineering campaigns. The A:L metric in the provided CVSS vector is notable: pure UI spoofing rarely causes direct availability impact, and this signal may reflect minor rendering disruptions or tab instability; the rationale is not elaborated in available data.

An attacker registers or compromises a website and serves a crafted HTML page that exploits the Geometry rendering bug to overlay or misposition a fake browser security indicator - such as a spoofed address bar, padlock icon, or permission prompt - over the legitimate Chrome UI. A targeted user visiting the page sees what appears to be a trusted origin or a benign download prompt, and is deceived into entering credentials or approving a sensitive browser permission. No public exploit code has been identified at time of analysis.