Google Chrome CVE-2026-7964

The vulnerability requires a compromised renderer process as a prerequisite; this is not a direct browser compromise path. The attacker must craft a malicious HTML page that triggers FileSystem API calls with invalid input that bypasses validation checks. User interaction (UI:R in CVSS) is required, meaning the user must visit or interact with the attacker's page while the renderer is already compromised. The vulnerability does not affect default Chrome installations without a prior renderer-level compromise; it is a post-exploitation condition rather than a primary attack vector. Exploitation is limited to the scope of the compromised renderer process, which may be constrained depending on the original compromise method.

CVSS 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates moderate but constrained risk. Network accessibility (AV:N) is offset by high attack complexity (AC:H), requiring both renderer process compromise and user interaction (UI:R). The impact is limited to confidentiality and integrity (C:L/I:L), with no availability impact. Chromium's security severity of 'Medium' aligns with the CVSS score. No KEV status or POC data provided, suggesting this is not yet actively exploited in the wild, though the vulnerability is credible given it affects a high-value target. Real-world exploitation requires a two-stage attack: first compromising the renderer process (via separate vulnerability or supply-chain attack), then leveraging this vulnerability. The high attack complexity and UI requirement significantly reduce practical risk compared to the CVSS base score alone. This appears to be a real but non-critical priority for most users, as it requires a pre-existing renderer compromise.

An attacker first compromises the Chrome renderer process through a separate vulnerability or malicious extension, then serves a crafted HTML page with malformed FileSystem API requests. The page exploits insufficient input validation in the FileSystem handler to bypass sandbox restrictions, allowing the attacker to read sensitive files (e.g., ~/.ssh, browser cache, credentials) or write malicious scripts to disk. The user must interact with the malicious page for the exploit to succeed, such as clicking a link or visiting an attacker-controlled website.