Google Chrome CVE-2026-7992

Requires Google Chrome version prior to 148.0.7778.96 running specifically on Linux or ChromeOS operating systems - Windows and macOS platforms are not affected. Victim must visit attacker-controlled or compromised website hosting crafted HTML page (AV:N). User must perform specific UI gesture sequences as prompted or tricked by the malicious page (UI:R) - mere page load is insufficient. The exact gesture sequences are not publicly disclosed in available references, but description emphasizes 'specific UI gestures' indicating non-trivial user interaction beyond simple clicks. No authentication required (PR:N), making any Chrome user on vulnerable platforms a potential target. Attack works against default Chrome configurations without requiring non-standard settings or extensions.

Real-world risk is moderate-high despite CVSS 8.8 score. The attack vector requires network access (AV:N) with low complexity (AC:L) and no authentication (PR:N), making delivery straightforward via malicious websites. However, required user interaction (UI:R) significantly limits exploitation - users must perform specific UI gestures, not just visit a page. EPSS data not provided, but social engineering difficulty for specific gesture sequences typically reduces exploitation probability compared to drive-by attacks. No CISA KEV listing indicates no confirmed active exploitation in critical infrastructure. The Medium Chromium security severity rating (vendor's internal assessment) appears lower than CVSS 8.8 suggests, possibly reflecting the specificity of required UI gestures or limited attack surface on Linux/ChromeOS compared to Windows. Patch availability in widely-deployed stable channel update substantially reduces window of opportunity. Priority should focus on Linux/ChromeOS Chrome deployments in environments where users might interact with untrusted web content.

Attacker hosts a malicious HTML page disguised as legitimate content (banking portal, social media, productivity tool). Victim using Chrome on Linux or ChromeOS visits the page. Through social engineering prompts embedded in the page design, attacker convinces user to perform specific UI gesture sequences (potentially drag-and-drop operations, context menu interactions, or keyboard combinations with mouse clicks). When user completes the required gestures, crafted malicious input bypasses UI validation checks and triggers code execution with browser process privileges, allowing attacker to execute arbitrary code on the victim's system.