Google Chrome EUVD-2026-65801

Exploitation requires two sequential preconditions: first, the attacker must have already compromised the Chrome renderer process via a separate, independent vulnerability - this is not a standalone exploit path; second, the target user must render or visit a crafted HTML page (user interaction required, UI:R). The flaw is in the Extensions subsystem and is present regardless of which browser extensions are installed. Key limiting factors: renderer compromise is a high technical bar that restricts realistic exploitation to sophisticated threat actors capable of chaining multiple browser bugs; and user interaction is required, ruling out fully automated or passive exploitation. Authentication is not a constraint per the PR:N CVSS metric, but the renderer compromise prerequisite effectively functions as an implicit access requirement not captured in the base score.

The vendor-assigned CVSS 4.3 score (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) encodes a medium-severity network-reachable flaw requiring user interaction, with limited confidentiality impact and no integrity or availability impact. However, the CVSS AC:L rating is likely underestimated: the CVE description explicitly requires a pre-existing renderer compromise as a prerequisite, which is a substantial technical bar absent from the CVSS encoding and which would warrant AC:H in an independent assessment. EPSS at 0.24% (15th percentile) corroborates low observed exploitation probability in the wild. The CVE is not in CISA KEV, and no public exploit code has been identified. The realistic threat model is a sophisticated browser exploit chain - an attacker exploits one renderer-level bug first, then pivots using this flaw - placing successful exploitation firmly in the domain of advanced threat actors rather than opportunistic or automated attacks.

An attacker targeting a specific user first exploits a separate renderer-level vulnerability - such as a V8 JavaScript engine bug - to compromise the Chrome renderer process, then serves a crafted HTML page that exercises the Extensions subsystem authorization flaw to break web origin isolation and read content from a privileged browser-internal page. No public exploit code for CVE-2026-79174 has been identified; successful exploitation requires chaining at least two distinct Chrome vulnerabilities.