Google Chrome EUVD-2026-50899

The attacker must have local access to the macOS machine where Chrome is running - this is an AV:L (local) vulnerability and cannot be triggered purely over the network. A victim user must actively open the crafted HTML page in Chrome on macOS (UI:R per CVSS), meaning social engineering or physical proximity is required. The flaw is Mac-platform-specific only; Chrome on Windows or Linux is not affected. The attack is not automatable (SSVC) and requires targeted setup. Limiting factors: no remote exploitation path exists; the attacker cannot cause integrity or availability impact; exploitation is constrained to scenarios where an untrusted party has both local system access and the ability to direct the victim's browsing activity.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N produces a Medium score of 5.5, reflecting that while confidentiality impact is rated High, the attack is strictly local and requires user interaction - conditions that substantially narrow real-world exploitability compared to network-facing vulnerabilities. EPSS at 0.11% (2nd percentile) indicates extremely low observed exploitation probability, consistent with the local-only vector. CISA SSVC rates exploitation as 'none,' automatable as 'no,' and technical impact as 'partial,' all pointing away from urgent prioritization. There is no CISA KEV listing and no known public proof-of-concept. Chromium's own Low severity classification reinforces that this is not considered a high-impact flaw internally. The primary risk scenario is a shared macOS environment where a malicious local user can direct a victim to a crafted page, making this largely irrelevant in single-user or well-managed enterprise macOS fleets. No signals conflict with each other - all sources consistently indicate low real-world priority.

A malicious local user on a shared macOS workstation hosts or links a crafted HTML page designed to trigger the Views memory disclosure path, then convinces or waits for a legitimate user to open it in an unpatched Chrome instance. The Views component inadvertently surfaces process memory contents accessible to the page, potentially exposing session tokens, cached credentials, or other sensitive in-memory browser data to the attacker. No public proof-of-concept is known at time of analysis, and the non-automatable SSVC rating indicates this requires deliberate, targeted setup rather than opportunistic mass exploitation.