Google Chrome CVE-2026-7995

Exploitation requires the victim to visit a malicious or compromised website containing specifically crafted HTML that triggers the AdFilter vulnerability. The attack succeeds against default Chrome configurations with no special settings required-AdFilter operates as part of Chrome's standard content processing pipeline. User interaction is mandatory (CVSS UI:R): the victim must actively navigate to the attacker-controlled URL through link clicks, typed URLs, or redirects. No authentication is required (PR:N), making any Chrome user a potential target regardless of logged-in state. The network attack vector (AV:N) means exploitation works remotely over standard HTTP/HTTPS connections. Exploitation is limited to the renderer process sandbox-achieving full system compromise requires additional sandbox escape vulnerabilities. Chrome installations with automatic updates disabled or enterprise deployments with delayed patch cycles face extended exposure windows, while standard consumer Chrome installations receive patches within days, significantly limiting the attack window.

This vulnerability presents moderate real-world risk despite its high CVSS 8.8 score. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-based exploitation with low complexity but requires user interaction (visiting a malicious page). The UI:R requirement significantly reduces automated exploitation potential, as attacks depend on social engineering or watering-hole tactics rather than worm-like propagation. Chromium's own security team assigned this a 'Medium' severity rating, suggesting internal risk assessment weighs the sandbox containment as a significant mitigating factor-code execution is limited to the renderer sandbox, not the underlying operating system. The vulnerability is NOT in CISA KEV, indicating no confirmed active exploitation. No EPSS data provided, but Chrome's rapid auto-update mechanism means most users will receive the patch within days of release, narrowing the exploitation window. Primary risk exists for enterprise environments with delayed patch cycles or users of Chromium-based browsers with slower update cadences. The combination of required user interaction, sandbox containment, and rapid patching makes this a moderate-priority issue rather than critical, despite the technical severity of achieving RCE.

An attacker creates a malicious website containing specially crafted HTML designed to trigger the out-of-bounds read in Chrome's AdFilter component. The attacker distributes the URL through phishing emails, malicious advertisements (malvertising), or by compromising legitimate websites frequented by targets. When a victim visits the page using a vulnerable Chrome version, the crafted HTML triggers the memory corruption, allowing the attacker to execute arbitrary code within Chrome's renderer sandbox-potentially stealing credentials from form fields, capturing session cookies, or exfiltrating data visible in the browser context. While sandbox escape would require chaining with additional vulnerabilities, sandboxed code execution alone enables significant data theft from the user's browsing session.