Google Chrome CVE-2026-79290

Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build (before 152.0.7977.65) - the CVSS UI:R confirms required user interaction, so a page visit or rendered content is mandatory; there is no drive-by-without-interaction path. No authentication or prior privileges are needed (PR:N), and it works against default Chrome configurations. The primary limiting factors are the need to get the victim to render the malicious page, Chrome's rapid auto-update (which shrinks the vulnerable window), and the absence of any observed exploit or automation (SSVC Automatable: no, Exploitation: none), meaning realistic use would require an attacker to develop a reliable UAF exploit first.

The signals are mixed but lean toward high priority for a desktop browser. CVSS 3.1 is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): network-reachable, low complexity, no privileges, but requiring user interaction (visiting a page), with a scope change reflecting the sandbox escape. Against that, EPSS is only 0.33% (25th percentile) and CISA SSVC records Exploitation: none and Automatable: no - so there is no evidence of active exploitation or mass-scannable automation, even though Technical Impact is total. This is the common profile of a freshly patched, high-severity Chrome memory bug: severe if weaponized, but no observed in-the-wild use yet, so exploitation is more likely to be targeted than widespread if it materializes. Given Chrome's ubiquity and Chrome's own auto-update cadence, any organization - from a large enterprise to a mid-sized municipal IT team - should still treat patching as routine-urgent rather than deferring it, because sandbox escapes are prime candidates for later exploit development.

An attacker hosts a malicious web page (or injects malicious content via a compromised ad or site) and entices a victim running a vulnerable Chrome build to open it. The page's crafted HTML/script triggers the use-after-free in Aura, corrupting browser-process memory to gain code execution outside the sandbox. No public exploit is identified at time of analysis, but the low attack complexity means only a single page visit is required once a working exploit exists.