Google Chrome CVE-2026-7978

Requires Google Chrome for macOS prior to version 148.0.7778.96 with Companion component active (handles cross-device features like handoff and continuity, typically enabled by default on macOS). CVSS vector PR:N confirms no authentication required, but AC:H indicates high attack complexity requiring specialized conditions such as attacker-controlled network position to inject malicious traffic into Companion protocol exchanges, precise timing to exploit race conditions or state manipulation in privilege transitions, or specific companion device pairing states. Platform limitation to macOS excludes Windows, Linux, and mobile Chrome users from attack surface. UI:N confirms no user interaction required once network conditions are met, but the Companion component must be processing network traffic at time of attack.

CVSS 8.1 (High) driven by network attack vector with high confidentiality, integrity, and availability impact, but real-world risk is moderated by high attack complexity (AC:H) and platform-specific nature. Not listed in CISA KEV, indicating no confirmed active exploitation. No publicly available exploit code identified. EPSS data not provided, but privilege escalation from remote network vector represents significant risk for targeted attacks against macOS Chrome users. The combination of unauthenticated remote access (PR:N) with OS-level privilege gain is severe, but AC:H suggests exploitation requires sophisticated technique, precise timing, or specific network conditions. Chromium security severity rated Medium conflicts with CVSS High score - vendor may assess lower practical exploitability due to complexity constraints. Priority for macOS enterprise environments running Chrome; lower urgency for heterogeneous fleets where attack surface is limited.

Remote attacker crafts malicious network traffic targeting Chrome's Companion component on a macOS system. When the victim's Chrome browser processes this specially-crafted network data during companion device synchronization or handoff operations, the inappropriate implementation allows the attacker to break privilege boundaries and execute code with OS-level permissions, gaining full system control beyond browser sandbox. High attack complexity suggests exploitation requires precise timing, specific network positioning, or multi-step interaction with Companion protocol.