Google Chrome EUVD-2026-35227

User interaction is required - the victim must navigate to or be redirected to a crafted HTML page (CVSS UI:R). The CVSS vector confirms the attacker requires no authentication and no special network position (AV:N, PR:N, AC:L). The vulnerability is specific to Chrome's Guest View component, meaning it is most directly relevant to environments using webview-based Chrome features (e.g., Chrome Apps, Electron-derived wrappers that embed Chrome's webview). Exploitation is limited by the Unchanged scope (S:U), meaning an attacker cannot use this bug alone to escape the browser sandbox or access the host OS. The impact is constrained to limited confidentiality and availability effects (C:L, A:L, I:N), with no integrity compromise. The primary limiting factor for exploitation impact is that UI spoofing without code execution requires significant social engineering to translate into a meaningful breach.

The CVSS score of 5.4 (Medium) reflects a network-accessible, low-complexity attack requiring no privileges but needing user interaction (UI:R), with limited confidentiality (C:L) and availability (A:L) impact and no integrity impact (I:N). The Unchanged scope (S:U) means the vulnerability does not enable privilege escalation or sandbox escape. Compounding the moderate CVSS, the EPSS score of 0.05% places this at the 15th percentile - well below the threshold typically associated with active exploitation campaigns. There is no CISA KEV entry, and no public exploit code has been identified at time of analysis. The tags 'Information Disclosure' corroborate the limited confidentiality impact signal in the CVSS vector. Overall, this is a real but lower-priority issue: the attack surface is broad (any Chrome user visiting a malicious page) but the impact ceiling is low (UI deception, not code execution or data exfiltration), and exploitation probability is currently very low.

An attacker registers a domain and serves a crafted HTML page that triggers the improper Guest View implementation in Chrome. When a victim running a vulnerable Chrome version visits the page (e.g., via a phishing link or malvertising), Chrome renders spoofed UI elements - such as a falsified address bar display or security badge - that make a malicious origin appear legitimate, potentially tricking the user into submitting credentials or trusting harmful content. No public exploit code has been identified at time of analysis, and no active exploitation has been reported.