Google Chrome EUVD-2026-34701

Exploitation requires two concrete prerequisites that substantially constrain real-world risk. First, the attacker must have already achieved renderer process compromise - a separate, independent exploit is required before this CVE is usable at all. Second, user interaction is required (CVSS UI:R), meaning the victim must visit or engage with attacker-controlled content. The CVSS AC:H further reflects that combining these conditions is non-trivial. From the CVSS vector, no authentication to the target system is required (PR:N). Exploitation is limited to confidentiality impact only (C:L/I:N/A:N) - no code execution, no data modification, no denial of service. Exploitation is further bounded to desktop Chrome versions below 149.0.7827.53; patched systems are not affected.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N conveys several important risk-limiting signals: High Attack Complexity (AC:H) because exploitation requires a prior renderer compromise as a prerequisite; User Interaction (UI:R) because the victim must visit or interact with a crafted page; Unchanged Scope (S:U) meaning the attacker cannot escalate beyond the browser's security boundary into the OS; and only Low Confidentiality impact with no integrity or availability consequence. EPSS at 0.02% (6th percentile) is extremely low, consistent with the pre-condition requirement and limited impact. No CISA KEV listing is confirmed, meaning active in-the-wild exploitation has not been documented by that source. Chromium's own security team rated this Low severity, which aligns with all quantitative signals. This is not a standalone exploitable vulnerability - it is a second-stage primitive usable only after a separate renderer exploit, making it a low real-world priority for most defenders unless operating in high-assurance environments where chained browser exploits are a modeled threat.

An attacker first exploits a separate, more severe vulnerability to compromise a Chrome renderer process - for example, a memory corruption bug triggered by visiting a malicious website - then leverages this CVE by having the now-hostile renderer send crafted input to the Loader component via a specially constructed HTML page. The Loader's failure to validate that input allows the renderer to issue requests that cross site isolation boundaries, enabling the attacker to read limited data from another site loaded in the same browser session. No public exploit code for this specific vulnerability has been identified at time of analysis.