Google Chrome EUVD-2026-34583

Exploitation requires that a victim user visit and render a crafted HTML page in an unpatched version of Google Chrome (prior to 149.0.7827.53); this is confirmed by UI:R in the CVSS vector. No authentication to Chrome or any web service is required by the attacker (PR:N). The vulnerability is present in the Keyboard subsystem, implying that keyboard-related events or API interactions on the malicious page are involved in triggering the flaw - the exact triggering mechanism (specific keyboard event type, API call sequence) is not detailed in available public data. There is no indication of a non-default configuration requirement; the flaw appears to affect standard Chrome installations. Exploitation is limited by: (1) the need to socially engineer a victim into visiting the attacker's page, (2) the requirement that a valuable target origin (e.g., authenticated session) be simultaneously open in the same browser profile, and (3) browser security features such as Enhanced Safe Browsing that may block navigation to known-malicious pages.

The CVSS base score of 6.1 (Medium) is driven by AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The Scope:Changed component elevates real-world impact above what C:L/I:L alone suggests, since cross-origin script injection can harvest authentication tokens, session cookies, and DOM state from any site loaded in the browser - a higher practical impact than the per-component CIA ratings imply. User interaction (UI:R) is a meaningful real-world barrier: a victim must be lured to and render a crafted HTML page. EPSS at 0.06% (18th percentile) reflects low observed exploitation pressure at time of scoring, consistent with the absence of KEV listing and no identified POC. No public exploit code has been identified, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The overall risk profile is moderate: the bug is unauthenticated and remotely triggerable, but UI:R and the low EPSS suggest it is not being actively mass-exploited. Browser vendors patch UXSS issues promptly given their strategic value to threat actors, making timely upgrade the clear priority.

An attacker hosts a crafted HTML page that manipulates Chrome's Keyboard API in a manner that triggers the inappropriate implementation flaw, causing the browser to execute attacker-supplied JavaScript in the context of a different, higher-value origin (e.g., an active banking or webmail session open in another tab). The victim need only visit the malicious page - no further interaction beyond page load and potentially a keyboard event is required. No public proof-of-concept exploit code has been identified at time of analysis, but the UXSS primitive would be directly leverageable for session hijacking or credential theft across co-loaded origins.