Google Chrome EUVD-2026-34749

Exploitation requires a victim running Google Chrome prior to 149.0.7827.53 to visit an attacker-controlled or attacker-influenced web page (mandatory user interaction, UI:R per CVSS vector). The attacker does not need any authentication or account on the target system (PR:N per CVSS). Attack complexity is rated low (AC:L), meaning no race condition or special timing is required. The primary limiting factor is the social engineering or redirect step needed to deliver the crafted page to the victim - Chrome will not process the malicious CSS without the user navigating to the page. No special Chrome configuration, feature flag, or non-default setting is stated as required; exploitation targets default desktop Chrome behavior. The vulnerability produces confidentiality loss only (C:H, I:N, A:N), limiting attacker utility to data theft rather than code execution or system compromise.

The CVSS 6.5 Medium score is driven by AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - network-reachable with low complexity and no privileges needed, but requiring user interaction and producing no integrity or availability impact. The high confidentiality impact (C:H) reflects that cross-origin data reads can expose sensitive authenticated session data. However, three converging signals push real-world risk significantly lower: EPSS at 0.03% (11th percentile) indicates minimal observed exploitation probability; Google's own Chromium severity designation is 'Low'; and no KEV listing or public POC exists. This divergence between CVSS C:H and low practical severity likely reflects the difficulty of reliably extracting meaningful data via CSS side-channels in practice. For most organizations, this is a patch-when-convenient issue rather than an emergency, though the zero-cost remediation (browser auto-update) makes deferral unnecessary.

An attacker hosts a crafted HTML page containing CSS designed to exploit Chrome's insufficient policy enforcement - for example, abusing CSS loading behavior or rendering side effects to infer or read content from a cross-origin authenticated resource. The victim is directed to this page via phishing, malvertising, or an embedded link; upon rendering the page in a vulnerable Chrome version, the CSS mechanism leaks cross-origin data back to the attacker without the user granting any explicit permission. No public exploit or POC has been identified at time of analysis, and the attack requires successfully luring the victim to the crafted page.