Google Chrome EUVD-2026-50872

Exploitation requires two sequential conditions: first, the attacker must have already compromised the Chrome renderer process through a separate, preceding vulnerability - CVE-2026-17946 is not independently exploitable from the network. Second, the victim user must interact with a crafted HTML page that triggers the uninitialized memory read in the Dawn WebGPU component (UI:R). The prerequisite renderer compromise is the dominant limiting factor, making this vulnerability relevant only within an exploit chain or browser exploit kit scenario. Limiting factors: renderer process compromise required as a precondition (significant barrier), user interaction with attacker-controlled content required, and no active exploitation identified (SSVC: Automatable: no, Exploitation: none). Default Chrome sandbox configurations constrain the blast radius of any renderer compromise, further reducing practical impact.

Real-world risk is materially lower than the NVD CVSS 6.5 base score implies. The critical qualifier is that the CVE description explicitly requires the attacker to have already 'compromised the renderer process' - meaning this is not a standalone attack vector but a chained second-stage capability. The published CVSS vector (PR:N/UI:R) does not fully encode this prerequisite, understating effective attack complexity. EPSS at 0.19% (9th percentile) confirms negligible exploitation probability in the wild. SSVC corroborates: exploitation status is none, the attack is not automatable (chained exploit requirement), and technical impact is only partial. No CISA KEV listing and no public POC have been identified. Chromium's internal severity classification of Low aligns with this analysis. The C:H confidentiality impact accurately reflects what memory disclosure can yield, but the renderer compromise prerequisite represents a substantial real-world barrier that defenders should weigh against the raw CVSS number.

An attacker who has first exploited a separate, unrelated Chrome renderer vulnerability to gain code execution inside the sandboxed renderer process then triggers WebGPU operations in Dawn via a crafted HTML page, causing uninitialized memory to be read and returned. The leaked memory contents could include sensitive in-process data such as authentication tokens, page content from other tabs sharing the renderer, or cryptographic material. No public proof-of-concept for this specific CVE has been identified at time of analysis.