Google Chrome EUVD-2026-50911

The victim must navigate to an attacker-controlled or attacker-influenced HTML page using a vulnerable Chrome desktop build (any version prior to 151.0.7922.72), satisfying the UI:R requirement. No authentication to Chrome or any web service is required, and no non-default Chrome configuration is necessary since the Web Speech API is available in default desktop Chrome installations. The attack is constrained by: (1) required user interaction - the victim must visit the page, ruling out zero-click network exploitation; (2) desktop platform scope - the CPE and advisory target desktop Chrome; and (3) the Speech subsystem must be reachable, which is default on desktop. No specific user gesture beyond page load appears required based on the AC:L rating.

The NVD CVSS score of 6.5 (Medium) conflicts with the Chromium security team's own 'Low' severity rating, suggesting the practical exploitability or real-world impact is constrained. EPSS at 0.18% (8th percentile) corroborates this: exploitation is not occurring at scale and no weaponized code is known. The vulnerability is not listed in the CISA KEV catalog. The CVSS vector requires user interaction (UI:R), which filters out entirely automated, mass-scanning attack classes. The Unchanged scope (S:U) in the provided NVD vector is potentially conservative for a site isolation bypass - such bypasses typically cross security boundaries - but the Chromium team's Low rating implies the exploitable integrity impact may be narrow. The combination of low EPSS, no KEV status, UI:R constraint, and vendor-Low classification places this as a moderate operational priority: patch during the next scheduled update cycle rather than emergency response. One signal conflict to note: the NVD vector lists I:H (high integrity) with S:U (unchanged scope), which is unusual for a site isolation bypass and may reflect a bounded form of cross-origin integrity violation rather than a full process escape.

An attacker hosts a malicious web page that invokes the Web Speech API in a crafted sequence designed to trigger the policy enforcement gap in Chrome's Speech component. When a victim visits the page and Chrome processes the HTML (requiring no additional user gesture beyond navigation), the Speech subsystem fails to apply proper inter-origin policies, allowing the attacker's page to achieve high-integrity impact against the browser context. No public proof-of-concept code has been identified at time of analysis, making reliable exploitation currently dependent on independent vulnerability research.