Google EUVD-2026-20665

The vulnerability exists in WebML, a subcomponent of Chrome's rendering engine, and is classified as a heap buffer overflow (CWE-122). Heap buffer overflows occur when code writes data beyond the allocated bounds of a heap-allocated buffer, potentially corrupting adjacent heap structures and allowing attackers to read or corrupt memory. In this case, the vulnerability enables information disclosure-attackers can craft malicious HTML pages that trigger the overflow condition, allowing them to read adjacent heap memory containing potentially sensitive data such as encryption keys, authentication tokens, or other process state. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) indicates network accessibility, low attack complexity, and no privilege requirements, though the UI:N designation in this context reflects that user interaction (visiting a webpage) is required in practice for Chrome's sandbox model.