Google Chrome EUVD-2026-27963

Requires victim to navigate to attacker-controlled or compromised webpage via clicking a link, opening email attachment, or visiting a watering-hole site (CVSS UI:R). The vulnerability affects default Chrome configurations prior to version 148.0.7778.96 with no special settings required. Exploitation is limited by the need for user interaction - the attacker cannot force the victim's browser to process malicious cookies without some form of social engineering or drive-by browsing. No authentication required (PR:N), meaning any internet user running vulnerable Chrome versions can be targeted. The network attack vector (AV:N) and low complexity (AC:L) indicate exploitation is straightforward once user interaction occurs, with no dependency on timing, race conditions, or environment-specific configurations.

Real-world risk is moderate to high based on multiple factors. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-based attacks with low complexity requiring no privileges but needing user interaction, making this exploitable through social engineering at scale. The 8.8 CVSS score reflects high impact across all three security properties (C:H/I:H/A:H), meaning successful exploitation grants significant control. However, the UI:R requirement substantially reduces attack surface compared to zero-click vulnerabilities. Chrome's automatic update mechanism means most users receive patches within days, limiting exposure windows. Critical missing data: EPSS exploitation probability not provided, making statistical risk assessment impossible. KEV status absent - no confirmation of active in-the-wild exploitation. POC availability unknown from provided references. SSVC technical impact would be rated high given privilege escalation, but automatable rating is partial due to UI requirement. The discrepancy between Chromium's 'Medium' internal severity and NVD's 8.8 CVSS suggests contextual factors may limit real-world impact - verify whether this requires specific user actions beyond page visit or affects only certain Chrome configurations.

An attacker hosts a malicious webpage or injects crafted HTML into a compromised legitimate site. The page contains specially crafted cookie values that exploit Chrome's insufficient input validation. When a victim visits the page (via phishing email, malicious ad, or watering-hole attack), the browser processes the malicious cookies. Due to improper validation, the attacker's payload escalates privileges within the browser's security context, potentially enabling arbitrary code execution, cross-origin data theft, or sandbox escape. Public POC status unknown from available references.