Google Chrome CVE-2026-84355

Exploitation requires two cumulative conditions: (1) the victim must visit or be redirected to a crafted HTML page served by the attacker (UI:R), and (2) the attacker must have already achieved code execution within Chrome's renderer process via a separate, independent vulnerability - the renderer compromise is a hard prerequisite that this CVE alone does not provide. The SOP bypass is limited to confidentiality (read-only cross-origin access, C:L); it does not allow modification of cross-origin resources or any availability impact. Exploitation is limited to Chrome versions prior to 152.0.7977.75 on any desktop platform where Chrome is installed.

The real-world risk of this vulnerability is constrained. The CVSS 3.1 base score of 3.1 (Low) reflects the high attack complexity: exploitation requires a pre-compromised renderer process as a prerequisite, making this a chained exploit rather than a standalone attack primitive. SSVC confirms exploitation status as 'none' and automatable as 'no,' consistent with the AC:H assessment. EPSS data is absent from the input, but given SSVC's assessment and the renderer-compromise prerequisite, opportunistic mass exploitation is implausible. The confidentiality impact is limited (C:L) - an attacker can read some cross-origin data but cannot write or cause availability issues. No KEV listing and no public exploit code have been identified at time of analysis. This is a real but low-priority vulnerability: meaningful only as part of a larger exploit chain (e.g., a renderer RCE followed by this SOP bypass to exfiltrate cross-origin tokens). Priority patching is appropriate due to Chrome's ubiquity, but incident response escalation is not warranted absent other indicators.

An attacker first exploits a separate renderer-process vulnerability (e.g., a V8 or Blink bug) to gain code execution inside Chrome's sandboxed renderer. With the renderer compromised, the attacker then serves a crafted HTML page that abuses the navigation authorization flaw to issue cross-origin reads - for example, extracting authentication tokens or session cookies from a victim's banking or webmail session open in another tab. No public exploit code for this specific vulnerability has been identified at time of analysis.