Google Chrome EUVD-2026-50670

Exploitation has two explicit, sequential prerequisites: (1) the attacker must have already achieved code execution within Chrome's renderer process via a separate, independently-exploited vulnerability - this is stated verbatim in the CVE description and is the primary limiting factor; and (2) the victim user must interact with a crafted HTML page (CVSS UI:R), meaning passive drive-by exploitation without user action is not possible. No special Chrome configuration or feature flag is required beyond basic browsing. Factors limiting exploitation: renderer pre-compromise is a high bar requiring a distinct exploit chain; SSVC confirms the attack is not automatable; Chromium's own severity assessment is Low; and the EPSS score of 0.18% reflects near-negligible observed exploitation. The high integrity impact in CVSS applies only if both conditions are met simultaneously.

The NVD CVSS base score of 6.5 Medium contrasts with Chromium's own internal severity designation of Low - a meaningful discrepancy. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) does not fully reflect the critical prerequisite stated in the description: the attacker must have already compromised the renderer process, making this a chained vulnerability rather than a standalone exploit. The SSVC framework corroborates this: Exploitation is rated none, Automatable is no, and Technical Impact is only partial. The EPSS score of 0.18% (8th percentile) confirms very low exploitation probability in the wild. No KEV listing and no known public exploit code further reduce urgency. Real-world risk is substantially lower than the raw CVSS score implies: this vulnerability only matters as a component of a more complex exploit chain targeting an already-partially-compromised browser instance.

An attacker first exploits a separate, unpatched renderer-level vulnerability to gain code execution within Chrome's sandboxed renderer process on a victim's machine. With renderer control established, the attacker serves a crafted HTML page that triggers the insufficient input validation in Chrome's Navigation component, bypassing navigation restrictions to redirect the browser to a restricted cross-origin context or perform unauthorized navigation actions. No public exploit code is known at time of analysis, and the chained nature of this attack significantly limits its practical deployment.