Google Chrome EUVD-2026-50644

Exploitation requires that the victim is running Google Chrome prior to version 151.0.7922.72 on a desktop platform. The victim must be convinced to visit an attacker-controlled or attacker-influenced HTML page AND perform specific UI gestures while on that page - such as a drag-and-drop interaction - which is the key limiting condition explicitly stated in the CVE description. The CVSS UI:R metric confirms this user interaction is non-negotiable; passive browsing without interaction is not sufficient to trigger the flaw. The CVSS PR:N metric confirms no authentication or account on the target system is required from the attacker's perspective. Exploitation is further limited to scenarios where cross-origin data is accessible in the same browser session (e.g., another open tab or an embedded iframe) at the time the gesture occurs. No special server-side configuration or non-default Chrome settings are required.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N presents a baseline medium risk: the attack is network-delivered with no authentication requirement, but the mandatory user interaction (UI:R) is a meaningful barrier. The confidentiality impact is limited (C:L), with no integrity or availability consequences. The EPSS score of 0.18% at the 8th percentile strongly suggests this vulnerability is not being actively targeted in the wild, and the absence of a CISA KEV listing corroborates this. No POC code has been identified. Taken together, this is a real but low-urgency vulnerability: the primary risk comes from Chrome's ubiquitous deployment, meaning even a low-probability exploit scenario could reach millions of users. The user interaction prerequisite limits the threat to social-engineering attacks - phishing, malvertising, or malicious embeds - rather than opportunistic mass exploitation. This is a patch-and-move-on issue rather than an emergency response trigger.

An attacker crafts a malicious HTML page that embeds or references cross-origin content and is designed to trigger specific UI interactions - such as a user dragging an element - which invokes the vulnerable DataTransfer code path. The attacker distributes the link via phishing or malvertising to Chrome users running versions below 151.0.7922.72. When a victim visits the page and performs the prompted gesture, the browser leaks data from a cross-origin context (such as content from another tab or an embedded iframe from a different domain) to the attacker-controlled page, which can then exfiltrate it. No public exploit code has been identified at time of analysis.