Google Chrome EUVD-2026-35217

Exploitation requires two distinct conditions to be met simultaneously. First, the attacker must have already compromised the Chrome renderer process - a non-trivial prerequisite that typically requires exploiting a separate, high-severity vulnerability such as a renderer memory corruption bug. This prior compromise is the gating condition that drives the AC:H rating. Second, a victim user must interact with a crafted HTML page (UI:R), meaning the attacker needs a delivery mechanism such as a malicious website, phishing link, or injected advertisement. Exploitation is further limited to confidentiality impact only - no code execution, no persistence, and no integrity modification is achievable through this vulnerability alone. The scope is unchanged (S:U), meaning the attacker cannot break out of Chrome's sandbox via this CVE. Exploitation is not feasible against default Chrome deployments without the renderer already being under attacker control.

The CVSS score of 3.1 (Low) is internally consistent with the attack requirements and impact. The AC:H designator is critical: this vulnerability is not independently exploitable - it requires the attacker to have already compromised the Chrome renderer process, which itself would require exploiting a separate, potentially unpatched vulnerability. The actual exploitation chain is therefore substantially more complex than any single CVE suggests. Confidentiality impact is rated Low (C:L), meaning only partial or limited data could be leaked - not full credential or session token exfiltration in most scenarios. UI:R further constrains exploitability to sessions where a user visits an attacker-controlled page. No EPSS score was provided in the input data, so probability-based risk scoring cannot be performed. The vulnerability is not listed in CISA KEV, and no publicly available exploit code has been identified, indicating this has not been observed in widespread or opportunistic exploitation campaigns. Overall, this is a genuine but low-priority finding: meaningful only as a component of a multi-stage exploit chain, not as a standalone attack.

An attacker who has already exploited a separate Chrome renderer vulnerability to achieve renderer process compromise directs a victim user to a crafted HTML page. The malicious page triggers the insufficient input validation flaw in the New Tab Page, causing the renderer to leak cross-origin data (such as content from a page loaded in another tab or origin) back to the attacker. No public proof-of-concept code exists for this vulnerability at time of analysis, making real-world exploitation currently limited to sophisticated actors capable of chaining multiple Chrome exploits.