Google Chrome EUVD-2026-50728

Exploitation requires the target to be running Google Chrome prior to 151.0.7922.72 on a desktop platform and to actively visit a specially crafted HTML page served by the attacker - mandatory user interaction (UI:R per CVSS vector). No authentication, credentials, or elevated privileges are required of the attacker (PR:N). No non-default browser configuration or feature flag is specified as a prerequisite in available data; Chrome's default Site Isolation mode is the assumed operational state. Key limiting factors: the attack is non-automatable (SSVC confirmed), meaning drive-by mass exploitation without user engagement is not viable; scope is unchanged (S:U), meaning the attacker cannot pivot from the browser to the underlying OS through this flaw alone; and impact is constrained to partial confidentiality (C:L) and limited availability (A:L) with no integrity compromise, capping the attacker's achievable gain from a single exploitation event.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L reflects a network-reachable, low-complexity attack requiring one deliberate user action (visiting a page), yielding only partial confidentiality and limited availability impact without scope change. These metrics alone would suggest moderate urgency. However, cross-referencing with additional signals substantially reduces real-world priority: EPSS at 0.22% (13th percentile) places this well below the threshold for active exploitation trending; CISA SSVC explicitly rates exploitation as 'none' and the attack as non-automatable, consistent with the required user interaction; and no CISA KEV listing or POC code is identified. The 'Automatable: no' SSVC determination aligns with UI:R - mass exploitation campaigns are structurally hampered. The Tags field lists 'Authentication Bypass,' which appears to reference the site isolation boundary bypass rather than credential or session bypass in the traditional sense. The A:L (availability) component is not clearly explained by the description alone; it is accepted from the NVD vector but its mechanism is unconfirmed. Net assessment: this is a genuine but non-urgent medium-severity issue - patch in the next standard cycle; no emergency response warranted.

An attacker registers a domain and hosts a crafted HTML page engineered to trigger the Site Isolation implementation flaw - for example, a page that manipulates frame navigation or origin assignment to escape process isolation. The attacker distributes the link via phishing email or malicious advertisement. A target running an unpatched Chrome visits the page, causing the browser to improperly isolate the malicious origin and allowing the attacker to read a limited portion of cross-origin data from another site the user has open or recently visited. No public proof-of-concept has been identified at time of analysis.