Google Chrome EUVD-2026-50737

Exploitation requires the victim to actively visit a crafted HTML page in a Chrome desktop installation running any version prior to 151.0.7922.72, confirmed by CVSS UI:R (user interaction required). No authentication is required of the attacker (PR:N), and attack complexity is low (AC:L), meaning no race condition or special configuration is needed beyond the user visiting the attacker-controlled page. Exploitation is limited to confidentiality impact only (C:L); no integrity or availability compromise is possible through this vulnerability. The specific Blink feature that bypasses origin validation is not publicly disclosed, which modestly limits commodity exploitation. Victims running Chrome with auto-update enabled who have updated to 151.0.7922.72 or later are not exploitable.

CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a network-reachable, low-complexity attack with limited confidentiality-only impact and no integrity or availability consequences. EPSS at 0.21% (11th percentile) places this well below the exploitation probability threshold seen in high-priority vulnerabilities, signaling this is not currently targeted at scale. No CISA KEV listing and no publicly identified exploit code further reduce immediate operational urgency. However, Chrome's ubiquitous deployment across enterprise and consumer endpoints means even a low-probability exploit represents meaningful aggregate exposure - particularly for high-value targets where cross-origin leakage could expose session tokens, authentication cookies, or sensitive page content loaded in adjacent tabs or frames. CVSS signals and EPSS are consistent and not conflicting here; this is a real but lower-priority issue absent active exploitation evidence.

An attacker registers or compromises a website and embeds a crafted HTML page that exploits the Blink origin validation flaw, then distributes the URL via phishing email or malicious advertising. When a victim visits the page in an unpatched version of Chrome, the page's JavaScript silently reads data from a cross-origin context - such as a banking portal or corporate intranet loaded in a nearby tab or embedded frame - and exfiltrates it to the attacker's server. No public exploit code has been identified at time of analysis.