Google Chrome EUVD-2026-50889

Exploitation requires the victim to actively visit an attacker-controlled web page using a Google Chrome version prior to 151.0.7922.72 - user interaction (UI:R) is a hard prerequisite and cannot be bypassed, making this non-automatable per SSVC. No special Chrome configuration or non-default settings are required; the SVG origin validation flaw exists in the standard browser rendering path. The value of any leaked cross-origin data is contingent on what authenticated sessions the victim holds in their browser at the time of visit - a victim with no sensitive sessions open yields no actionable data. Exploitation does not require the attacker to be authenticated to any system. Limiting factors include: mandatory per-user social engineering or malicious ad delivery to reach victims, reliance on the victim having a relevant active session, and the absence of automatable delivery chains (SSVC: Automatable: no).

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable attack (AV:N) with no privilege required (PR:N) but mandatory user interaction (UI:R), yielding only limited confidentiality impact (C:L) and no integrity or availability impact (I:N/A:N). These metrics are internally consistent with the described scenario. EPSS at 0.17% (7th percentile) signals very low near-term exploitation probability, and CISA's SSVC decision places exploitation at 'none', technical impact at 'partial', and automatable at 'no' - all corroborating a low operational risk posture. The non-automatable classification is significant: mass exploitation is not feasible without per-user interaction, limiting attacker scalability. The primary concern is targeted information-disclosure attacks against users with valuable authenticated sessions (e.g., internal tooling, OAuth tokens) where a cross-origin leak could serve as a stepping stone. For most organizations, this is a routine patch-cycle item rather than an emergency response.

An attacker registers a domain and serves a crafted HTML page embedding SVG markup that silently references authenticated cross-origin endpoints the target victim is likely to have active sessions on (e.g., an internal dashboard or SaaS tool). When the victim navigates to the attacker's page in an unpatched Chrome browser, the SVG renderer improperly leaks data from those cross-origin resources to the attacker's JavaScript context, allowing exfiltration of sensitive content. No public exploit code has been identified at time of analysis, and the low EPSS score suggests opportunistic exploitation is not currently occurring.