Google Chrome EUVD-2026-50723

Exploitation requires the attacker to occupy a privileged/adjacent network position (AV:A) able to intercept or inject into the victim's traffic - an adversary-in-the-middle on the path between Chrome and its Variations/config endpoint - and to deliver a specifically malformed Variations payload parsed at fetch time. No authentication (PR:N) and no user interaction (UI:N) are needed on the victim side, but AC:H reflects genuine limits: the attacker must already control the network path, defeat the transport protections around the Variations fetch, and win a heap-corruption race, which is why Google rates it Medium. It is not exploitable from an arbitrary internet host and does not work against a victim on a fully trusted, non-intercepted network.

The signals point to a real-but-conditional risk rather than mass-exploitation. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 7.5) requires an adjacent/privileged network position (AV:A) and high attack complexity (AC:H), so the attacker must already be able to intercept or manipulate the victim's traffic - a meaningful barrier. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no POC was supplied, so there is no public exploit identified at time of analysis. Google's own Chromium rating of Medium is more conservative than the 7.5 'High' CVSS band, suggesting practical exploitability (MITM plus defeating heap ASLR and the sandbox) is lower than the raw score implies. Note a conflict in the source data: the tag says 'Information Disclosure' while the description describes heap corruption - verify true impact with the vendor advisory.

An attacker who controls a network segment the victim uses - a rogue Wi-Fi access point or compromised upstream router - intercepts Chrome's Variations seed fetch and returns a crafted malformed payload. Chrome's Variations parser mishandles the untrusted input and corrupts the heap, potentially yielding a memory-safety primitive in the browser process. No public POC exists, and the high attack complexity plus required network position make this a targeted rather than commodity attack.