Google Chrome EUVD-2026-50907

Exploitation requires the victim to visit an attacker-controlled crafted HTML page - a passive user interaction (clicking a link or being redirected) is the necessary trigger. No special browser configuration, extension, or non-default feature is identified as a prerequisite; the vulnerability is present in default Chrome installations prior to 151.0.7922.72. The CVSS vector PR:N confirms no attacker authentication is required. Key limiting factors: (1) UI:R - the attack cannot proceed without the victim loading the crafted page, ruling out automated mass exploitation; (2) impact is read-only cross-origin data leakage (C:L), with no ability to modify data or cause denial of service; (3) the attacker must know or guess a cross-origin resource URL worth targeting, adding practical difficulty. No platform-specific condition (OS, locale, or feature flag) is identified from available data.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a network-accessible, low-complexity flaw requiring no attacker authentication, but mandating user interaction, with only limited confidentiality impact and no integrity or availability consequence. EPSS at 0.17% (7th percentile) is very low, indicating the broader security community does not anticipate near-term exploitation. SSVC corroborates this: 'Exploitation: none, Automatable: no, Technical Impact: partial.' The 'Automatable: no' finding aligns directly with UI:R - mass drive-by exploitation without any user action is not feasible. No KEV listing and no known POC further reduce real-world urgency. In practice, this is a genuine but low-priority vulnerability: meaningful for environments hosting sensitive cross-origin data where phishing risk is elevated, but not an emergency for general enterprise patching cycles. No conflicting signals are present in the available data.

An attacker crafts an HTML page containing JavaScript that exploits Blink's improper origin validation to read data from a cross-origin resource the victim is authenticated to - such as an intranet page or session-authenticated API response. The attacker delivers the page link via phishing email or malicious advertisement, and when the victim's unpatched Chrome loads it, the cross-origin data is exfiltrated to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, and the attack cannot be fully automated without victim interaction.