Google Chrome EUVD-2026-35221

Exploitation requires that the victim user visit a crafted HTML page in an affected Chrome version (prior to 149.0.7827.103) - this is the sole prerequisite, as confirmed by the UI:R flag in the CVSS vector. Chrome's built-in Passwords feature must be active, which is the default configuration for Chrome desktop installs; no non-default setting is required. The attack is unauthenticated (PR:N), meaning the attacker needs no account or session on any system. What limits exploitation: the victim must take an active step to navigate to the attacker's page (UI:R), the data exposure is low in scope (C:L, S:U - no privilege escalation or cross-scope impact), and the flaw is specific to the Passwords subsystem rather than a general renderer bypass. Users with Chrome's password manager disabled have reduced but not necessarily zero exposure, as the exact internal trigger path is not fully described in public disclosures.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) characterizes this as a network-reachable, low-complexity attack requiring no privileges but necessitating user interaction - specifically, a victim visiting a crafted page. The impact is confined to low confidentiality loss with no integrity or availability impact, yielding a base score of 4.3 (Medium). No EPSS data was provided, limiting probabilistic exploitation forecasting. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept exploit has been identified at time of analysis. The combination of required user interaction, limited data exposure scope (C:L), and absence of active exploitation signals suggests this is a genuine but lower-urgency patch priority compared to unauthenticated RCE-class issues. The Passwords feature is enabled by default in Chrome, slightly expanding the attack surface compared to optional features.

An attacker hosts a malicious HTML page containing crafted JavaScript or markup designed to trigger the flawed behavior in Chrome's Passwords component, then lures a target user to visit the page via phishing, a compromised ad, or a malicious link. Upon page load and interaction with the Passwords subsystem, the browser inadvertently exposes data belonging to a different origin - potentially including credential-related state - to the attacker-controlled page. No public proof-of-concept exploit has been identified at time of analysis, but the low attack complexity (AC:L) suggests the triggering mechanism is straightforward once the interaction condition is met.