Google Chrome EUVD-2026-50927

User interaction is required: the victim must actively visit an attacker-controlled or compromised web page containing the crafted HTML/WebGL payload (UI:R in the CVSS vector). No authentication, installed software, or special browser configuration is required on the victim side - any Chrome version prior to 151.0.7922.72 with WebGL enabled (the default) is susceptible. Exploitation is limited by: (1) UI:R - passive network-level attack is not possible; (2) the attack yields a memory read from the GPU process, not arbitrary code execution, so converting the leak into meaningful impact requires the attacker to know or guess what sensitive data is in memory; (3) Chrome's GPU process sandbox constrains what memory is accessible, reducing the blast radius of any leak.

The CVSS 3.1 score of 6.5 (Medium) is driven by AV:N/AC:L/PR:N/UI:R with C:H/I:N/A:N - a straightforward drive-by scenario requiring only a page visit with no authentication. However, multiple signals temper the urgency: EPSS at 0.16% (6th percentile) places this well below the threshold for opportunistic mass exploitation; no KEV listing confirms there is no observed active exploitation; and no public POC has been identified. Google's own internal severity designation is 'Low', which reflects the practical difficulty of reliably leaking meaningful secrets from GPU process memory versus arbitrary code execution. The gap between the CVSS C:H rating and Google's Low severity label is notable and should be weighed - the theoretical confidentiality impact is high, but operationalising the leak into actionable credential theft or sensitive data exfiltration from GPU process memory is non-trivial. Real-world priority should be moderate: patch as part of normal update cadence rather than emergency response.

An attacker hosts a crafted HTML page containing malicious WebGL shader or draw-call sequences that trigger the inappropriate implementation bug and cause the browser to leak adjacent process memory contents back to the page's JavaScript context. The attacker then exfiltrates this memory over the network, potentially recovering tokens, keys, or other sensitive data that happened to be resident in the GPU process at the time. No public POC exists, and reliable exploitation would require precise heap-shaping to surface meaningful secrets.