Google Chrome CVE-2026-84356

The victim must navigate to an attacker-controlled HTML page using a vulnerable version of Google Chrome (< 152.0.7977.75) and must actively interact with or permit a fullscreen transition - user interaction is required (UI:R per CVSS). No authentication to any backend service is required from the attacker (PR:N), and no special server-side configuration is needed. Exploitation is bounded by the following limiting factors: (1) the victim must grant or interact with a fullscreen permission prompt, which modern Chrome may accompany with a visible warning; (2) impact is confined strictly to UI deception - no data is directly exfiltrated and no code executes on the victim system; (3) the vulnerability does not affect mobile Chrome or embedded Chromium builds based on available data.

The CVSS 4.3 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) is well-calibrated: no authentication barrier, no configuration prerequisite, and no elevated attack complexity reduce deployment friction for an attacker, but the mandatory user interaction (UI:R) and purely integrity-based impact (I:L) substantially constrain real-world severity. EPSS at 0.16% (6th percentile) corroborates the low exploitation probability, and no KEV listing or public exploit code has been identified - even a mid-sized municipal IT team in tczew should treat this as a routine patch-cycle item rather than an emergency response. Chrome's own 'Low' severity rating is internally consistent with the absence of data theft or code execution; the primary threat model is phishing facilitation where a victim is deceived about which site they are interacting with.

An attacker registers a lookalike domain and hosts a page that leverages Chrome's fullscreen API to trigger a UI transition that obscures or replaces the visible address bar content with a convincing replica of a target site such as a banking portal or corporate SSO login. A victim browsing to the attacker's page who accepts the fullscreen prompt sees a visually identical login form with a spoofed URL indicator and submits credentials to the attacker. No public exploit code has been identified, but the technique is well within reach of threat actors familiar with browser fullscreen APIs.