Google Chrome EUVD-2026-34734

Exploitation requires the victim to be running Google Chrome prior to version 149.0.7827.53 on a desktop platform. The CVE description explicitly states the attacker must convince the user to 'engage in specific UI gestures' on a crafted HTML page - passive drive-by exploitation without active user interaction within the browser UI is not possible, as confirmed by the UI:R CVSS component. No authentication is required from the attacker (PR:N). The exact nature of the UI gestures is not publicly disclosed in available data; additional detail may be restricted in the Chromium issue tracker at https://issues.chromium.org/issues/501757688. Exploitation is further limited to the Omnibox component and is not triggered by arbitrary page visits alone. Users on Chrome 149.0.7827.53 or later are not affected.

The CVSS 6.1 Medium score aligns with the Chromium security team's own 'Low' severity classification, reflecting a meaningful but constrained risk profile. The vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) presents a mixed picture: network-accessible, low-complexity, unauthenticated access lowers the bar to attempt exploitation, but the mandatory user interaction (UI:R) and dual-low impact scores (C:L/I:L) cap the ceiling. The Changed Scope component elevates the score to reflect cross-origin capability, which is the most consequential aspect of UXSS. EPSS at 0.07% (22nd percentile) corroborates low real-world exploitation probability. This vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified. The combination of required UI gestures, low EPSS, no KEV listing, and Google's own low-severity designation places this as a routine patch-cycle item rather than an emergency response priority - though in targeted attack scenarios, UXSS capability should not be dismissed.

An attacker registers a domain and hosts a crafted HTML page designed to trigger the Omnibox validation flaw when specific UI gestures are performed, such as interactions that cause the Omnibox to process attacker-controlled input. After socially engineering the victim into visiting the page and performing the required interaction, injected scripts execute in the context of a trusted origin already open in the browser - potentially harvesting session tokens, cookies, or displayed credentials from banking or email sites. No public exploit code has been identified at time of analysis, meaning exploitation currently requires custom development.