Google Chrome EUVD-2026-50852

Exploitation requires the victim to be running Google Chrome prior to version 151.0.7922.72 on a desktop platform, as the vulnerability is in the desktop DevTools component. The attacker must successfully social-engineer the victim into both visiting a crafted HTML page and completing specific UI gestures - the exact nature of which is not disclosed in available public data but is described as non-trivial, consistent with Chromium's Low internal severity rating. DevTools does not need to be explicitly opened by the user. Exploitation is fundamentally limited by the mandatory user interaction requirement (UI:R), which prevents automated or silent mass exploitation and requires per-victim social engineering. There is no elevated privilege or authenticated session required on the attacker's side. Exploitation is further constrained to desktop Chrome; mobile Chrome builds are not scoped by the available CPE data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates a network-delivered, low-complexity, unauthenticated attack with no scope change and high integrity impact, but requiring user interaction. This required UI gestures element is the primary real-world friction point: the attack cannot be silently triggered against passive victims and depends on social engineering success. EPSS at 0.18% (8th percentile) places this well below the exploitation threshold seen in actively targeted vulnerabilities, consistent with Chromium's own Low severity classification - which notably diverges from the NVD's Medium CVSS score of 6.5. No KEV listing and no reported POC further deprioritize this relative to other Chrome findings. The high integrity impact likely reflects the ability to bypass navigation controls (e.g., enabling cross-origin redirects or violating iframe policies) rather than arbitrary code execution. This is a routine patch-cycle priority, not an emergency response item, for most organizations.

An attacker registers a convincing domain and hosts a crafted HTML page designed to manipulate Chrome's DevTools input handling. After social-engineering a victim into visiting the page and interacting with specific UI elements (such as prompted clicks or dialog interactions), the attacker's page exploits the validation flaw to bypass Chrome's navigation restrictions, potentially enabling cross-origin navigation or policy-violating redirects that would otherwise be blocked. No public POC has been identified at time of analysis.