Chrome EUVD-2025-18662

This vulnerability presents critical real-world risk. The CVSS 8.8 (High) score reflects: (1) Network attack vector requiring no privileges, (2) Low attack complexity—no special conditions needed, (3) User interaction required (UI:R)—a minor friction point, (4) High impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The use-after-free class (CWE-416) is a classic remote code execution primitive. The absence of provided EPSS data limits probabilistic exploitation assessment, but use-after-free vulnerabilities in widely-used browsers typically score 0.95+ EPSS. KEV status unknown from provided data; however, browser metrics components are frequently targeted. The combination of network accessibility, minimal user interaction, and code execution capability makes this a legitimate priority regardless of EPSS—this is not a false-positive high-CVSS issue. Attack complexity is low because no specific browser state or user actions beyond normal browsing are required.

An attacker crafts a malicious HTML page containing JavaScript that triggers improper memory management in Chrome's Metrics subsystem. The attacker hosts this page on a website or embeds it in a phishing email. When a victim visits the page (via link click or preview), the use-after-free is triggered, corrupting the heap and allowing the attacker to overwrite adjacent memory with shellcode. The attacker gains arbitrary code execution in the Chrome process context, enabling data theft (passwords, cookies, cached data), malware installation, or lateral movement to other systems. No special victim privileges are required; the attack succeeds against any user viewing the page in an unpatched Chrome browser. If a proof-of-concept exists in the wild (status unclear from provided data), exploitation difficulty drops further, making this a critical priority for patching before widespread adoption.