Google Chrome EUVD-2026-50880

The victim must actively open a specially crafted MHTML (.mht/.mhtml) file in a vulnerable version of Chrome (prior to 151.0.7922.72). This maps directly to the CVSS UI:R metric - exploitation cannot occur passively through a normal web browse; the user must trigger MHTML file loading. PR:N confirms no authentication to any service is required on the attacker's side. The attack is limited to confidentiality (reading cross-origin data) and cannot modify data or cause a crash. Exploitation is further constrained by Chrome's sandbox: even a successful exploit cannot escape the renderer process to affect the underlying OS. The non-default nature of deliberately opening MHTML files limits the realistic victim pool in most enterprise environments.

Real-world risk is low despite Chrome's ubiquitous deployment. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a network-reachable, unauthenticated attack path, but the mandatory user interaction (UI:R) - the victim must open a crafted MHTML file - materially reduces exploitability. Scope is unchanged (S:U), meaning the exploit cannot escape the browser's sandbox or affect other system components. Confidentiality impact is rated Low (C:L), limiting the attacker to partial cross-origin data reads rather than full exfiltration. EPSS at 0.17% (7th percentile) signals that automated or mass exploitation is highly unlikely. No CISA KEV listing and no public POC corroborate low active-threat activity. Chromium's own team graded this 'Low' severity. The combination of required user action, limited data exposure, and absence of any exploitation signals makes this a low-priority patch-cycle item, though still worth addressing given Chrome's massive installed base.

An attacker hosts or distributes a malicious MHTML archive file and socially engineers a target into opening it in Chrome - for example, via a phishing email with an attached .mhtml file or a link that triggers a download-and-open workflow. Once the victim opens the file, the crafted MHTML content exploits the origin validation error to read data from a cross-origin context accessible to the victim's browser session, potentially leaking session-sensitive content from a trusted site the user is logged into. No public POC is known, so exploitation would require independent vulnerability research to weaponize.