Google Chrome EUVD-2026-50858

Exploitation requires the victim to be running Google Chrome on Windows (not other platforms) with a version prior to 151.0.7922.72. The attacker must cause the victim to open a crafted HTML page in Chrome - active user interaction (UI:R) is required, meaning silent background exploitation is not possible. No elevated privileges are needed (PR:N), but physical or logical local access context is implied by AV:L. The vulnerability is specific to the DataTransfer component, meaning only interactions involving clipboard or drag-and-drop API paths on Windows are in scope. Limiting factors include: Windows-platform-only scope, mandatory user interaction with attacker-controlled content, local attack vector ruling out remote unauthenticated exploitation, and no automation vector per SSVC assessment.

The CVSS base score of 5.5 (Medium) reflects a local, user-interaction-dependent attack path that constrains exploitability despite the C:H sub-score. EPSS corroborates low urgency at 0.11% probability of exploitation within 30 days (2nd percentile), and CISA SSVC confirms no observed exploitation and non-automatable delivery. There is no CISA KEV entry and no public proof-of-concept identified at time of analysis. The 'Denial of Service' and 'Memory Corruption' tags in the intelligence feed are consistent with UAF primitives that often carry DoS side effects, though the NVD description restricts confirmed impact to information disclosure. The local attack vector is the dominant risk-limiting factor: an attacker must either have local access to the victim machine or find a way to have a crafted HTML page opened in Chrome on Windows - ruling out opportunistic internet-scale exploitation. Chromium internally rated this severity as 'Low.' Overall, this is a genuine but low-priority vulnerability: real for targeted scenarios (e.g., shared workstations, social engineering), but not a mass-exploitation risk.

A local attacker or social engineer delivers a crafted HTML page to a Windows user running an unpatched version of Chrome - for example, via a shared network folder, email attachment, or an internal link. When the victim opens the page in Chrome, the malicious JavaScript manipulates the DataTransfer API to trigger a use-after-free condition, causing the browser to read freed memory and potentially exposing session tokens, cached credentials, or other sensitive in-process data to the attacker. No public proof-of-concept has been identified, meaning exploitation currently requires independent vulnerability research to develop a working primitive.