Google Chrome EUVD-2026-50888

Exploitation requires the victim to actively navigate to or be redirected to an attacker-controlled HTML page - confirmed by UI:R in the CVSS vector - making social engineering or drive-by delivery a necessary precondition. The attack is unauthenticated (PR:N per CVSS) and network-delivered (AV:N), with no special browser configuration or account privileges required. The UXSS impact depends on the victim having other authenticated web sessions open in the same browser instance, as the injected scripts derive value from cross-origin context access. SSVC rates the attack as non-automatable, meaning mass exploitation via scanning or automated payloads is not feasible - targeted delivery is required. The attack is further limited to Chrome versions strictly below 151.0.7922.72; updated browsers are not affected.

The CVSS 3.1 score of 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N reflects a network-reachable, low-complexity attack requiring no privileges but mandating user interaction, with a scope change denoting cross-origin impact and individually Low confidentiality and integrity ratings. EPSS at 0.17% (7th percentile) confirms negligible current exploitation activity. SSVC signals no known exploitation, a non-automatable attack path, and only partial technical impact. The vendor's own 'Chromium security severity: Low' designation further depresses urgency. No KEV listing and no public POC have been identified. While UXSS is a serious vulnerability class in principle, the convergence of low EPSS, absent exploitation history, non-automatable SSVC rating, and vendor-assigned Low severity places this firmly in the patch-on-schedule rather than emergency-response tier.

An attacker constructs a specially crafted HTML page that triggers Blink's improper implementation and then lures a victim into visiting it via a phishing email, malicious advertisement, or compromised website redirect. Once the victim's Chrome browser renders the page, the injected scripts execute in the context of arbitrary origins within the browser session, potentially harvesting session cookies or credentials from banking, email, or enterprise web applications the victim has open. No public proof-of-concept exploit code has been identified at the time of analysis.