Google Chrome EUVD-2026-34750

Exploitation requires the victim to visit a crafted HTML page in an unpatched version of Google Chrome (prior to 149.0.7827.53) - user interaction is confirmed required per CVSS UI:R. The attacker must be able to serve attacker-controlled content that executes in the victim's browser context alongside a cross-origin target resource the victim is authenticated to or has access to. No authentication is required from the attacker's side (PR:N confirmed by CVSS). Exploitation is limited by: (1) mandatory victim interaction - passive network presence is insufficient; (2) the technical difficulty of reliably measuring Paint-level side channels in real browser environments subject to OS scheduling and rendering jitter; (3) Chrome's existing process isolation, which bounds the leak to readable cross-origin data rather than code execution or memory corruption; and (4) the scope being unchanged (S:U), ruling out privilege escalation or sandbox escape as part of this vulnerability chain.

The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) presents a mixed picture. Network reachability (AV:N), low complexity (AC:L), and no required privileges (PR:N) elevate the theoretical attack surface, and the high confidentiality impact (C:H) indicates meaningful data exposure potential. However, mandatory user interaction (UI:R) and unchanged scope (S:U) - meaning no sandbox escape or privilege escalation - substantially limit the blast radius. The EPSS score of 0.03% at the 11th percentile is strikingly low given the CVSS profile, suggesting the exploitation mechanics are complex in practice, consistent with Chromium's own 'Low' severity designation. No CISA KEV listing and no public POC further confirm this is not a mass-exploitation threat. This vulnerability is a real priority for users who cannot update Chrome promptly, particularly those handling sensitive cross-origin authenticated sessions, but is not an emergency patch for most enterprise environments relative to higher-EPSS peers.

An attacker crafts a malicious HTML page that loads a cross-origin resource (such as an authenticated page or image the victim has access to) alongside JavaScript that measures Paint rendering timing or state differences in Chrome's compositing pipeline. When the victim is lured to the attacker's page via a phishing link or malicious advertisement, the side-channel observations are used to reconstruct or infer data from the cross-origin resource - potentially exposing session-specific content, authentication tokens embedded in rendered pages, or user-specific data. No public exploit code has been identified at time of analysis; building a reliable exploit would require detailed knowledge of Chrome's Paint internals.