Google Chrome EUVD-2026-50724

Exploitation requires the victim to be running Google Chrome prior to version 151.0.7922.72 on any supported desktop platform, and to actively visit a crafted HTML page under attacker control - the UI:R CVSS metric confirms this user interaction is mandatory and non-bypassable. The Presentation API must be active, which it is by default in all standard Chrome installations; no special feature flag or non-default configuration is required on the victim's side. The attacker must control a web origin capable of hosting the malicious page and must have a mechanism to deliver it to the target (phishing, malvertising, or compromised web property). Exploitation is strictly bounded to confidentiality - the CVSS I:N/A:N metrics confirm no write capability or denial-of-service is achievable. The data leakage is limited to browser-accessible cross-origin content visible within the same browser session, not arbitrary filesystem or OS data.

The CVSS 3.1 score of 4.3 (Medium) is consistent with the threat model: AV:N/AC:L/PR:N confirm unauthenticated network reachability with no special configuration, but UI:R introduces mandatory social engineering friction and S:U bounds impact to the browser sandbox. C:L/I:N/A:N correctly scopes the issue as a read-only data disclosure with no write or denial-of-service capability. The EPSS score of 0.21% at the 11th percentile strongly suggests this is not being exploited opportunistically or at scale. There is no CISA KEV listing and no public exploit code has been identified, meaning exploitation currently demands custom tooling. Real-world priority should be assessed against the victim population: organizations with users frequently handling sensitive web sessions (banking portals, enterprise SSO, healthcare applications) face higher residual risk than general-purpose environments. This is a genuine security issue warranting inclusion in the next standard patch cycle but does not justify emergency out-of-band response for most organizations.

An attacker registers a domain and hosts a crafted HTML page that opens a Presentation API session targeting the victim's browser, exploiting the origin validation flaw to read data from a co-resident origin (such as an enterprise SSO portal open in another tab). The victim is directed to the page via a phishing email or malicious advertisement. No public exploit code has been identified, so practical exploitation currently requires the attacker to develop custom JavaScript leveraging the Presentation API's improper boundary enforcement.