Google Chrome CVE-2026-84357

User interaction via social engineering is required (CVSS UI:R) - the attack cannot be delivered passively and requires the victim to interact with attacker-controlled content or be exposed to crafted network traffic in a targeted manner. No authentication or privileges are required from the attacker side (PR:N), but the social engineering prerequisite limits the attack's scalability. The vulnerability affects Chrome prior to 152.0.7977.75 on all desktop platforms; no specific non-default configuration or feature enablement is described as a prerequisite. Exploitation is limited by the mandatory user-interaction step and the absence of a known automated or wormable delivery path.

The provided CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) captures the core dynamic: the attack is network-reachable and requires no authentication, but demands user interaction via social engineering, which meaningfully limits scalability. Integrity impact is rated high, reflecting the ability to bypass origin controls and potentially manipulate cross-origin content, while confidentiality and availability are unaffected. EPSS of 0.16% at the 5th percentile is very low and aligns with the social-engineering prerequisite. No CISA KEV listing and no known public POC further reduce urgency. Chromium has internally rated this 'High' severity, consistent with its potential to undermine fundamental browser security boundaries, but real-world exploitation at scale is constrained by the required user interaction. This is a genuine but operationally manageable risk - patching is the correct response, but emergency/out-of-band response is not indicated.

An attacker crafts a phishing campaign directing victims to a malicious site or delivers crafted network traffic (e.g., via a rogue Wi-Fi AP or DNS manipulation), exploiting the Omnibox validation flaw to present a spoofed or misrepresented origin to the browser. The victim, deceived into interacting with the content, allows the attacker to bypass the same-origin policy and perform integrity-affecting operations - such as injecting content or actions - that should be restricted to a different origin. No public POC exists at the time of analysis.