Google Chrome EUVD-2026-28057

The victim must be using Google Chrome prior to version 148.0.7778.96 and must actively visit a crafted HTML page controlled by the attacker - passive exposure (e.g., pre-loaded tabs) is not sufficient based on the UI:R CVSS metric. No authentication to the target application is required from the attacker's perspective, but the value of the attack depends on the victim being authenticated to a sensitive cross-origin resource in the same browser session. No non-default Chrome configuration or feature flag is described as a prerequisite. Exploitation is limited by the user-interaction requirement (attacker cannot remotely trigger without victim participation), the partial impact ceiling (C:L/I:L), and the requirement for a browser session context with co-loaded sensitive origins. Automated mass exploitation is assessed as 'no' per SSVC.

Real-world risk is moderate-to-low despite the network-accessible attack vector. CVSS 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) reflects a low-complexity, unauthenticated attack requiring one user interaction (visiting a page). However, the provided scope metric (S:U) conflicts with the nature of a SOP bypass, which by definition crosses origin trust boundaries - this is more accurately reflected as S:C. The EPSS score of 0.02% (6th percentile) indicates very low likelihood of exploitation in the near term. SSVC assessment confirms no current exploitation and rates automatable as 'no' due to the required user interaction, with only partial technical impact. There is no CISA KEV entry and no public POC. The combination of low EPSS, no KEV, no POC, and a partial-impact ceiling means this is a genuine but not urgent security issue. Red Hat and SUSE tag coverage suggests downstream Linux distributions are tracking it for their Chrome/Chromium packages.

An attacker hosts a crafted HTML page that abuses Chrome's Canvas API to read pixel data from a cross-origin iframe or resource loaded in the same browser session. The victim is induced to visit the attacker's page (e.g., via phishing link), at which point the Canvas implementation improperly grants cross-origin read access, allowing the attacker to exfiltrate partial content from another origin the victim is authenticated to. No public proof-of-concept exists at time of analysis, so practical exploitation would require original research into the specific Canvas logic flaw.