Google Chrome CVE-2026-18014

The attack requires the victim to actively open or otherwise interact with a malicious file in Chrome (UI:R per CVSS), making social engineering or a crafted download an essential prerequisite - passive browsing alone is insufficient. The vulnerability is scoped to Chrome's DevTools component; whether DevTools must be explicitly open by the victim at the time of exploitation is not confirmed by available data, and this ambiguity affects realistic exploitability assessment. No authentication is required on the attacker's side (PR:N). Limiting factors include: the mandatory user interaction step, the absence of confidentiality or availability impact (navigation restriction bypass only, not code execution), the Chromium team's own 'Low' internal severity rating, and a very low EPSS score of 0.16%. The attack is constrained to Chrome desktop and does not affect non-Chrome browsers or server-side systems.

The NVD CVSS base score of 6.5 (Medium) reflects a network-accessible, low-complexity, no-privilege, user-interaction-required attack yielding high integrity and no confidentiality or availability impact (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). However, Chromium's own security team assigned an internal rating of 'Low', suggesting they consider the practical exploitability or real-world impact more constrained than the base CVSS implies - possibly because DevTools involvement narrows the attack surface or because navigation restriction bypass without further exploitation is of limited standalone value. EPSS at 0.16% (6th percentile) strongly corroborates low exploitation probability. The vulnerability is absent from the CISA KEV catalog and no public POC is known, meaning no public exploit identified at time of analysis. Taken together, these signals indicate this is a lower-priority patching item; the CVSS score overstates urgency relative to the actual exploitation landscape.

An attacker crafts a malicious file and delivers it to a target via phishing email, a compromised web page offering a download, or another social engineering vector. When the victim opens the file in an unpatched Chrome browser, the DevTools component processes the attacker-controlled input without adequate validation, allowing the attacker to bypass Chrome's navigation restrictions and potentially redirect the browsing context in unauthorized ways. No public POC is known and no active exploitation has been confirmed.