Google Chrome EUVD-2026-65770

Exploitation requires the victim to install or interact with a crafted Chrome extension through social engineering - this is the explicit attack delivery mechanism stated in the description. The Chrome version must be prior to 152.0.7977.65. The CVSS vector (PR:N/UI:R) confirms no attacker privileges are required but user interaction is mandatory; there is no drive-by or zero-click path. The Bluetooth component must be reachable from the extension context, implying the browser's Bluetooth subsystem is active. Exploitation is limited by: (1) the social engineering step required to deliver the malicious extension, (2) Chrome's extension installation prompts and review mechanisms, and (3) the requirement to run a vulnerable Chrome version. Sandbox escape is the distinguishing severity factor - without it, impact would be confined to the browser process.

The provided CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high severity, but the S:U (no scope change) metric appears inconsistent with the description, which explicitly states execution occurs 'outside the sandbox' - a textbook scope change. This discrepancy should be verified with Google's security advisory. Real-world risk is moderated by the EPSS score of 0.28% at the 20th percentile, indicating no meaningful exploitation activity observed at time of analysis. The vulnerability is not listed in CISA KEV. The social engineering prerequisite (convincing a user to install or interact with a malicious extension) adds friction compared to drive-by or zero-click attacks, but is well within the capabilities of targeted phishing campaigns. Given Chrome's ubiquitous deployment, even a low exploitation rate translates to a large absolute attack surface. Priority should be high for patch deployment due to the sandbox escape potential and product prevalence, even absent confirmed active exploitation.

An attacker crafts a malicious Chrome extension that triggers the use-after-free in Chrome's Bluetooth subsystem when activated. The attacker distributes the extension via a phishing campaign, a fake Chrome Web Store listing, or a compromised developer account, socially engineering the target into installing it. Upon installation or activation, the extension triggers the memory corruption, allowing the attacker to execute arbitrary code outside Chrome's sandbox with the privileges of the browser process on the host OS.