Google Chrome EUVD-2026-65760

Exploitation requires the victim to visit or render an attacker-crafted HTML page in Google Chrome on macOS prior to 152.0.7977.65 - i.e., mandatory user interaction (UI:R) driven by social engineering, per the description. No authentication or prior privileges are needed (PR:N), and the affected code path is the Safe Browsing component, which is enabled by default, so no special non-default configuration is required beyond running a vulnerable Chrome version on Mac. The primary limiting factors are the need to get a target to open the malicious page and the platform constraint (macOS builds specifically); there is no server-side or automatic-trigger vector.

The signals are mixed and should be weighed together rather than in isolation. The CVSS 3.1 base of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated sandbox escape with total confidentiality/integrity/availability impact - genuinely severe, and consistent with Chromium's 'Critical' rating and SSVC 'Technical Impact: total.' Counterbalancing this, exploitation is gated on user interaction (UI:R): the victim must be induced to visit a malicious page. The real-exploitation indicators are currently modest: EPSS is only 0.57% (45th percentile), SSVC reports Exploitation 'none' and Automatable 'no,' and there is no KEV listing or public PoC - so this is a high-severity-if-exploited issue rather than a demonstrated widespread threat today. That said, browser UAF sandbox escapes are historically attractive targets that are frequently weaponized after disclosure, and because Chrome is nearly universal, any organization running it on macOS - from large enterprises down to a small municipal IT team - should treat patching as urgent and not wait for KEV confirmation. Bottom line: prioritize the patch now on the strength of impact and product ubiquity, while noting that no active exploitation has yet been observed.

An attacker sets up a crafted HTML page and uses phishing or a malicious ad/link to lure a macOS Chrome user to it; when the page loads, it triggers the Safe Browsing use-after-free, corrupts heap memory, and escapes the sandbox to execute attacker code with the user's privileges. No credentials are needed, but the victim must open the page (UI:R). No public proof-of-concept is currently known, so this remains a plausible rather than demonstrated attack.