CVE-2026-78963: Improper input validation in Google Chrome

This vulnerability arises from improper input validation in the Media subsystem of Google Chrome versions before 152.0.7977.65. An attacker can craft a malicious HTML page that, when processed by the vulnerable Chrome version, may lead to arbitrary code execution outside the sandbox environment. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates the attack can be performed remotely over the network with low complexity, requires user interaction, and results in high confidentiality, integrity, and availability impacts.

Successful exploitation could allow a remote attacker to execute arbitrary code on the victim's system outside the Chrome sandbox, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability at a high level. No active exploitation in the wild has been reported.

The vendor advisory linked should be consulted for the latest remediation status. Since the vulnerability affects versions prior to 152.0.7977.65, updating Chrome to version 152.0.7977.65 or later is recommended if confirmed as a fixed version. Patch status is not explicitly confirmed in the advisory; therefore, users should verify the update availability and apply it promptly once confirmed.