Google Chrome CVE-2026-7957

Exploitation requires the attacker to have already compromised the Chrome renderer process through separate means - this vulnerability cannot be exploited directly from a network attack alone. The victim must be running Google Chrome on macOS or iOS (not Windows, Linux, or Android) with a version below 148.0.7778.96. User interaction is mandatory (UI:R) - the victim must navigate to or be convinced to visit an attacker-controlled webpage hosting the malicious HTML content with crafted media elements. The vulnerability exists in the Media component, so exploitation requires triggering media processing operations, though no specific non-default media features need to be enabled. Exploitation produces code execution constrained within Chrome's sandbox (S:U - unchanged scope), limiting impact to browser-context operations rather than system-level access.

Real-world risk is moderate despite the 8.8 CVSS score, constrained by multiple exploitation prerequisites. CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R indicates network-based attack with low complexity, no authentication, but mandatory user interaction (UI:R). Critically, the description specifies attackers must have 'already compromised the renderer process' - making this a second-stage exploitation primitive rather than initial access vector. The sandbox scope (S:U - unchanged) means code execution remains confined within Chrome's sandbox, limiting system-level impact. EPSS data not provided for comparative risk scoring. No CISA KEV listing indicates no confirmed active exploitation. No public POC status reported. This represents a sandbox escape building block that would require chaining with another vulnerability to achieve full system compromise. Security teams should prioritize patching Chrome installations but recognize this is not an immediate critical threat like renderer RCE vulnerabilities that bypass sandbox entirely.

An attacker hosts a weaponized HTML page containing specially crafted media content (video/audio stream with malformed metadata or codec parameters). After achieving initial renderer process compromise through a separate vulnerability or social engineering tactic, the attacker directs the victim to visit the malicious page on macOS or iOS Chrome. When Chrome's Media component parses the crafted media data, the out-of-bounds write triggers, allowing the attacker to execute arbitrary code within the sandbox boundary, potentially enabling data exfiltration from the browser context, cookie theft, or establishing persistence for subsequent sandbox escape attempts.