Google Chrome CVE-2026-7932

Exploitation requires the victim to be a local user with Chrome installed and active, AND the victim must open a crafted HTML page (via browser navigation, email link, or local file access) AND interact with that page in a way that triggers the Downloads handler (e.g., clicking a link, triggering a download action, or submitting a form). The vulnerability does NOT require authentication to Chrome, elevated system privileges, or any special Chrome configuration - it is a policy enforcement flaw in the default Downloads feature. The attack is strictly LIMITED to local attackers or remote attackers who can deliver the HTML to the target (e.g., via phishing), and it is LIMITED by the UI:R requirement (user interaction is mandatory). Remote network-based exploitation without user engagement is NOT possible. Systems running Chrome 148.0.7778.96 or later are NOT vulnerable.

This is a low-to-moderate priority issue with conflicting risk signals. The CVSS score of 4.4 reflects moderate severity: local attack vector (AV:L) and low complexity (AC:L) indicate relatively straightforward exploitation, but the requirement for user interaction (UI:R) and lack of confidentiality/integrity impact on the system itself (C:L/I:L/A:N) substantially limit real-world impact. The vulnerability does not result in remote code execution, privilege escalation, or denial of service. The Chromium project assessed this as 'Medium' severity, which aligns with CVSS 4.4 - below critical thresholds. No EPSS score, KEV status, or active exploitation evidence was provided in the input data, suggesting this is a responsibly disclosed issue rather than actively exploited malware vector. The primary risk is targeted attacks against users who open a malicious HTML page, potentially exposing sensitive download histories or allowing local file write access in restricted directories. This is a realistic but narrow threat model compared to network-based exploitation. Defender priority should reflect the requirement for user interaction and local presence; mass exploitation is unlikely.

An attacker crafts a malicious HTML page that, when opened by a user in Chrome, exploits the insufficient policy enforcement in the Downloads handler to bypass navigation restrictions. The user might visit this page via a phishing email or compromised website. Upon interaction with the page (e.g., clicking a link or triggering a download action), the attacker's HTML crafts a request that navigates to a restricted download directory or system location that should normally be blocked. This could allow the attacker to read the user's download history, access previously downloaded sensitive files, or write files to restricted directories if the Downloads policy also governs file write permissions. The attack requires the user to open the malicious page and interact with it - it does not occur passively.