Google Chrome CVE-2026-79292

Exploitation requires two concurrent preconditions: first, the victim user must navigate to a crafted HTML page (UI:R - active user interaction is mandatory and non-negotiable); second, the attacker must have already achieved code execution within Chrome's renderer process through a separate, unspecified vulnerability, since this integer overflow is a sandbox escape and not an initial-access primitive. The AC:H metric directly encodes this chained-exploit requirement. Limiting factors: the renderer pre-compromise requirement substantially raises the bar compared to a standalone remote code execution vulnerability; no single-step unauthenticated network exploitation path exists directly to this component. The Chromecast/Media Router component must be present and enabled in the Chrome installation, which is the default for standard desktop builds. No attacker authentication or privileged OS account is required once the renderer is controlled.

The CVSS 8.3 score (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects a tension between severe potential impact - full sandbox escape delivering complete host-level C/I/A compromise - and the significant exploitation complexity introduced by the mandatory two-stage attack chain. AC:H is the critical moderating signal here: no single-step exploitation path exists; the attacker must first compromise the renderer via a separate vulnerability before this integer overflow becomes reachable. EPSS at 0.30% (22nd percentile) directly supports this: the security community assigns very low near-term exploitation probability, consistent with chained-exploit requirements that limit opportunistic mass exploitation. This CVE is not listed in CISA KEV, and no public exploit code or POC has been identified in the available data. Despite these moderating factors, Chrome's near-ubiquitous enterprise and consumer deployment means that security teams should still prioritize patching rapidly: the severity of a successful sandbox escape justifies urgency even at low current exploitation probability, particularly for organizations running unmanaged or auto-update-disabled Chrome fleets. SSVC exploitation status is assessed as 'none' based on available signals, but technical impact is 'total' once the chain is assembled, and the vendor's 'High' severity rating aligns with this posture.

An attacker first exploits a separate, unspecified renderer vulnerability to gain code execution within Chrome's sandboxed renderer process - likely delivered via a crafted or compromised web page through phishing or malvertising - and then leverages the integer overflow in the Chromecast component to corrupt memory across the sandbox boundary, achieving arbitrary code execution at a higher privilege level on the host OS. The UI:R requirement means the victim must actively navigate to the attacker's page, making social engineering the realistic initial delivery mechanism. No public exploit or POC has been identified at time of analysis.