Google Chrome EUVD-2026-50909

Exploitation requires the victim to be running Google Chrome prior to version 151.0.7922.72 with the Global Media Controls feature active (enabled by default in all standard Chrome installations). The attacker must induce the user to visit a crafted HTML page (CVSS UI:R confirmed), making passive drive-by exploitation without any user navigation impossible. The spoofing effect is confined to the Global Media Controls overlay panel and does not extend to the main browser chrome, OS UI, or other applications. No authentication, elevated privileges, or non-default configuration is required on the victim's system. Exploitation is not automatable per SSVC, meaning mass or worm-style spread is not feasible. The impact ceiling is low-integrity UI deception; no code execution, credential exfiltration, or system compromise is achievable through this vulnerability alone.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N yields a score of 4.3 (Medium), accurately capturing network reachability without authentication but with mandatory user interaction, scoped to low integrity impact only - no confidentiality or availability loss. EPSS at 0.17% (7th percentile) is very low, and SSVC independently rates exploitation as 'none,' automatable as 'no,' and technical impact as 'partial,' forming a consistent picture of a low-exploitation-likelihood issue. One minor inconsistency: the supplied tag 'Information Disclosure' conflicts with CVSS C:N - the spoofing effect may mislead users about media origin in ways that indirectly enable disclosure, but direct data exfiltration is not supported by the CVSS metrics or description. This is a real but low-urgency vulnerability best resolved through Chrome's standard auto-update mechanism rather than emergency remediation.

An attacker hosts a crafted HTML page that triggers inappropriate rendering within Chrome's Global Media Controls popup, causing the overlay to display spoofed media metadata or controls - for example, attributing a malicious audio stream to a trusted news site or banking domain. When a user visits the page in an unpatched Chrome browser, the spoofed overlay could deceive them into believing they are interacting with a legitimate media player, potentially enabling phishing or misleading consent flows. No public proof-of-concept code has been identified, and the attack requires the victim to actively navigate to the attacker-controlled page.