Google Chrome CVE-2026-7953

The vulnerability requires user interaction: the victim must navigate to or interact with a page controlled by the attacker, or click a crafted link that triggers the Omnibox input processing. Exploitation is limited to Chrome versions prior to 148.0.7778.96. The Omnibox suggestion and address bar processing features must be enabled (default configuration). No special network position or authentication is required beyond the ability to deliver a malicious page or link to the target user. The scope change in CVSS (S:C) indicates the vulnerability impacts resources outside the Omnibox component, such as arbitrary web origins, making it more severe than a simple input validation flaw.

CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C) indicates a moderate network-exploitable vulnerability with low complexity and no privilege requirements, but requiring user interaction. The scope change (S:C) and integrity/confidentiality impact (I:L/C:L) reflect UXSS capability. Real-world risk is tempered by the UI:R requirement - an attacker must trick users into clicking a malicious link or navigating to a malicious page that triggers the Omnibox input path. The lack of KEV listing and public POC availability suggests this is not currently mass-exploited in the wild. However, UXSS vulnerabilities are high-value targets for targeted attacks against journalists, activists, or corporate users. The Medium severity rating from Chromium aligns with CVSS assessment but underscores that exploitation requires user interaction, limiting opportunistic attack feasibility. Organizations with high-value targets should prioritize patching; others can defer based on update cadence.

An attacker registers a domain or compromises a website to host a malicious page. When a user visits this page, JavaScript triggers a network request or navigation that causes Chrome's Omnibox to process attacker-controlled data. The Omnibox fails to properly validate the input, allowing HTML/script injection that executes with the privileges of the browsing context, potentially exfiltrating cookies, session tokens, or performing actions on behalf of the user across multiple origins.