Google Chrome EUVD-2026-50914

Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process through a separate vulnerability - this is explicitly stated in the CVE description ('a remote attacker who had compromised the renderer process'). The user must also visit an attacker-controlled crafted HTML page (UI:R), meaning user interaction is mandatory. No special Chrome configuration is needed beyond a standard browser session; however, the renderer pre-compromise prerequisite is the decisive limiting factor. Defenses that limit exploitation: Site Isolation (default on) constrains renderer scope; any endpoint detection of browser process anomalies; and the absence of a chained renderer-level exploit in the attacker's toolkit. Authentication to Chrome or Google services is not required for navigation bypass once the renderer is controlled.

The NVD-assigned CVSS vector (AV:N/AC:L/PR:N/UI:R) rates attack complexity as Low, which overstates the realistic bar: exploitation definitionally requires a prior renderer compromise, a non-trivial chaining condition that CVSS AC:L does not reflect. An independent assessment of AC:H is more accurate. EPSS at 0.18% (8th percentile) corroborates a low near-term exploitation probability. The flaw is not in CISA KEV and no POC has been identified. Chrome's security severity is rated Low by the Chromium team. In practice, this vulnerability matters primarily to attackers who are already executing within a compromised renderer and need to defeat navigation restrictions as part of a sandbox-escape chain. Organizations running current Chrome channels are protected by the 151.0.7922.72 patch. The real priority is low for most environments - high-value targets with sophisticated adversaries (nation-state, APT) capable of chaining renderer exploits represent the realistic threat model.

An attacker who has already achieved code execution within Chrome's renderer process - for example, via a separate V8 heap exploitation bug - crafts a malicious HTML page that sends specially formed navigation requests. The insufficient input validation in the Navigation component allows these requests to bypass navigation restrictions that would normally constrain a sandboxed renderer, enabling the attacker to navigate to privileged browser-internal pages or bypass cross-origin navigation policies as a step in a broader sandbox-escape chain. No public POC has been identified, making this scenario primarily relevant to sophisticated, multi-stage exploit chains.