Google Chrome EUVD-2026-35228

Physical access to the target device is the explicit and mandatory prerequisite, as confirmed by the CVSS attack vector AV:P. The attacker does not require any account credentials or authentication (PR:N), and no user interaction from the victim is needed (UI:N) beyond the attacker being present at the device. Attack complexity is Low (AC:L), meaning no special timing, race conditions, or brute-force is required once physical access is obtained. Exploitation is limited to scenarios where an attacker can directly interact with the hardware - remote exploitation is not possible. Non-default configurations or specific feature flags for Ozone are not described as prerequisites in the available data; the vulnerability appears present in default Chrome installations on affected platforms.

The CVSS base score of 6.8 reflects a meaningful tension: impact subscores are all High (C:H/I:H/A:H), but the attack vector is Physical (AV:P), which dramatically constrains real-world exploitability. Physical access is a hard prerequisite that eliminates remote and adjacent-network threat actors entirely. Attack complexity is Low (AC:L) and no privileges are required (PR:N), meaning that once an attacker has physical access, exploitation is not technically demanding. No EPSS data was provided in the intelligence feed, and this CVE does not appear on the CISA KEV list, indicating no confirmed active exploitation at the time of analysis. No public POC has been identified. For enterprise environments where devices may be left unattended or accessed by untrusted parties (shared workstations, kiosks, field devices), this is a meaningful risk that justifies patching. For environments with strong physical security controls, the practical risk is substantially lower than the impact subscores suggest. Google rated this Critical internally (Chromium security severity), likely reflecting the memory safety class and impact potential rather than the physical access prerequisite.

An attacker gains physical access to an unattended device running a vulnerable version of Chrome (prior to 149.0.7827.103) - for example, a shared workstation or unattended laptop. By interacting with the Chrome browser and triggering a specific sequence of operations within the Ozone display layer, the attacker causes a freed memory region to be referenced, enabling heap corruption. Successful exploitation could lead to arbitrary code execution within the Chrome process with high impact on confidentiality, integrity, and availability. No public POC has been identified at time of analysis.