Google Chrome EUVD-2026-50722

Exploitation requires the victim to actively visit an attacker-controlled or compromised HTML page using Google Chrome prior to version 151.0.7922.72 on a desktop platform - the CVSS UI:R metric confirms this user interaction is mandatory and cannot be bypassed. The Cast component must be active, which is the default configuration in Chrome desktop; no non-default configuration is required to be vulnerable. PR:N confirms no authentication or session privileges are needed from the attacker's side. Exploitation is limited to desktop Chrome installations (per CPE scope); the impact ceiling is limited cross-origin data disclosure (C:L) - no code execution, no data modification, no denial of service. The primary limiting factor for defenders is the mandatory user-navigation step, making phishing or drive-by delivery the required delivery mechanism.

The CVSS base score of 4.3 accurately reflects a bounded privacy risk: limited cross-origin data leakage (C:L) with no integrity or availability impact. EPSS at 0.21% in the 11th percentile signals very low exploitation probability, consistent with the absence of a CISA KEV listing and no identified public POC. The AC:L and PR:N metrics indicate that if a user visits a malicious page, exploitation mechanics are straightforward - there is no complex exploit chain to execute - but the mandatory UI:R gate (victim must navigate to the attacker page) provides a meaningful real-world friction point. The Chromium team's own Medium classification aligns with the NVD score. This vulnerability is a genuine but lower-priority patching target: it poses a meaningful cross-site data privacy risk (e.g., leaking authenticated session content across origins) but carries no remote code execution or system integrity risk. Organizations running Chrome at scale should prioritize this patch as part of routine update cycles rather than emergency response.

An attacker registers a convincing domain and hosts a crafted HTML page that invokes Chrome's Cast subsystem with maliciously structured input. When a victim using an unpatched Chrome version (below 151.0.7922.72) visits this page - delivered via phishing, malvertising, or a compromised site - the insufficient input validation in the Cast component allows the page to read data from a cross-origin context, potentially exposing authenticated content (e.g., tokens, user data) from another open tab or iframe. No public exploit code has been identified at time of analysis, so exploitation requires independent capability to develop the triggering HTML payload.