Google Chrome EUVD-2026-34718

Exploitation requires the victim to actively visit or load an attacker-controlled HTML page in Google Chrome prior to version 149.0.7827.53 - user interaction (UI:R per CVSS) is a hard, non-bypassable prerequisite. The attack is unauthenticated (PR:N) and network-delivered (AV:N), meaning no credentials or prior foothold are needed, but a fully silent or automated exploitation chain is not possible. No special Chrome feature flag, non-default configuration, or specific platform is indicated as required by available data. Exploitation is further limited by the impact scope: only navigation restriction integrity is affected, with no access to confidential data (C:N) and no availability impact (A:N), making this insufficient as a standalone attack. In enterprise environments where Chrome is configured with enforced navigation policies (e.g., managed kiosk profiles), the bypass could undermine those controls - defenders in such contexts should assess priority accordingly.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N reflects a network-accessible, low-complexity attack requiring no privileges but mandating user interaction, with only limited integrity impact and unchanged scope. Google's internal Chromium severity is Low, which is consistent with the CVSS score of 4.3. EPSS at 0.02% (4th percentile) strongly corroborates minimal real-world exploitation interest - this vulnerability class and severity level are rarely operationalized by threat actors. There is no CISA KEV listing and no known proof-of-concept exploit. The impact ceiling is navigation restriction bypass only - no code execution, no credential exposure, no availability disruption - making this an exceptionally poor standalone attack primitive. Risk is elevated only in narrow contexts such as enterprise kiosk deployments, managed browser environments with navigation sandboxing as a security boundary, or where navigation bypass could be chained with a separate higher-severity flaw. No conflicting signals exist across data sources; all available intelligence consistently places this in the low-priority tier.

An attacker registers a malicious domain and hosts a crafted HTML page designed to trigger Chrome's navigation implementation flaw, then distributes the URL via phishing email or a compromised third-party website. A victim running Chrome prior to 149.0.7827.53 who clicks the link causes their browser to bypass navigation restrictions, allowing the attacker's page to redirect the browser to an unintended destination or escape frame navigation sandboxing. No public proof-of-concept exploit has been identified at time of analysis, and the mandatory user interaction step limits the attack's scalability.