Google Chrome EUVD-2026-34714

Exploitation requires the victim to actively visit a crafted HTML page in an affected Chrome desktop version prior to 149.0.7827.53 - user interaction is mandatory (UI:R per CVSS vector). The attack is network-delivered with no authentication required (PR:N), so any remote attacker capable of serving web content can attempt it. The race condition root cause (CWE-362) means exploitation reliability is inherently timing-dependent and may not succeed consistently, potentially requiring repeated page visits or specific system load conditions to hit the narrow synchronization window - this is a practical limiting factor not captured by the AC:L CVSS rating. Impact is strictly limited to confidentiality (C:L): no code execution, no data modification, and no service disruption are achievable through this vulnerability. Non-default configurations are not required - the Permissions subsystem is active in all standard Chrome deployments. Google's Low severity rating for this issue reflects both the limited impact scope and the constrained exploitation reliability.

The CVSS 3.1 score of 4.3 (Medium) reflects network delivery (AV:N), low attack complexity (AC:L), no required privileges (PR:N), mandatory user interaction (UI:R), unchanged scope (S:U), limited confidentiality impact (C:L), and no integrity or availability impact (I:N/A:N). The unchanged scope and confidentiality-only impact constrain this well below critical thresholds. The CWE-362 race condition classification is notable - race conditions in browser permission logic typically have variable reliability, as exploitation depends on precise timing that may require multiple attempts or favorable system load conditions, effectively raising practical complexity beyond the AC:L rating. No EPSS score was provided in the input data, leaving probabilistic exploitation likelihood unquantified. The vulnerability is absent from CISA KEV, no POC has been identified, and Google's own Chromium team rated this Low severity - all signals converging on a lower-priority issue despite its network-accessible attack vector. This is not a high-priority emergency patch, but cross-origin data leaks can expose authentication tokens or sensitive page content in targeted scenarios, so timely patching remains advisable.

An attacker hosts a crafted HTML page engineered to trigger a race condition in Chrome's Permissions subsystem at the moment a cross-origin resource access check is evaluated. The victim is socially engineered - via phishing email, malicious ad, or compromised link - into visiting the attacker-controlled page in an unpatched version of Chrome (prior to 149.0.7827.53), satisfying the UI:R requirement. If the timing window is hit successfully, the attacker's page reads data from a different origin (such as session tokens or page content from a logged-in web application), exfiltrating it to the attacker's server with no integrity or availability impact to the victim's system. No public exploit code has been identified at time of analysis.