Chrome EUVD-2026-20728

Victim must install a malicious Chrome extension that contains crafted code targeting the V8 use-after-free vulnerability. This requires social engineering to convince the user to install the extension from an untrusted source or through a compromised legitimate extension update. Chrome's extension permission system and Web Store review process provide baseline protections, but determined attackers can bypass these through phishing campaigns, typosquatting, or supply-chain compromise of existing extensions. Enterprise environments with ExtensionInstallBlocklist policies enforced are not vulnerable unless the malicious extension is explicitly whitelisted. Default Chrome installations without extension installation restrictions remain vulnerable if users can be tricked into installation.

Multi-signal risk assessment reveals significant divergence between theoretical severity and practical exploitability. CVSS 8.8 reflects maximum theoretical impact (C:H/I:H/A:H) assuming successful exploitation, with network attack vector (AV:N) and low complexity (AC:L). However, critical mitigating factors include mandatory user interaction (UI:R) requiring victim to install a malicious extension - a non-trivial social engineering hurdle given Chrome Web Store review processes and browser warnings. EPSS score of 0.01% (1st percentile) indicates security researchers and threat actors assess actual exploitation probability as negligible, with no observed in-the-wild activity. No CISA KEV listing confirms absence of confirmed active exploitation. Chromium's internal 'Low' severity rating directly contradicts the high CVSS score, suggesting their risk assessment weighs real-world attack prerequisites heavily. SSVC framework analysis: exploitation status is 'none' (no public POC), automatable is 'no' (requires user installation action), technical impact is 'total' (RCE potential). The PR:N (no privileges required) vector component is misleading - while network-accessible, the attack requires user-granted extension privileges. Overall assessment: moderate priority for patching user-facing Chrome deployments, low priority for enterprise environments with extension whitelisting policies. The high CVSS rating is not reflective of actual risk given exploitation barriers.

Attacker develops a malicious Chrome extension disguised as a legitimate productivity tool or browser enhancement and distributes it through phishing emails, malicious advertisements, or compromised websites bypassing Chrome Web Store review. Victim installs the extension, granting it permissions to execute JavaScript in the browser context. The extension delivers a crafted payload targeting the V8 use-after-free condition, triggering heap corruption that allows arbitrary code execution within the browser sandbox. Successful exploitation enables attacker to steal credentials, intercept browsing data, inject malicious content into web pages, or pivot to sandbox escape exploits. No public proof-of-concept code exists at time of analysis, but the attack vector's reliance on user installation significantly raises the difficulty threshold compared to drive-by attacks.