Google Chrome EUVD-2026-65778

Exploitation requires a victim to open attacker-controlled content in a vulnerable Chrome build before 152.0.7977.65 (UI:R - the crafted HTML page must be loaded), but needs no authentication or prior privileges (PR:N) and works over the network against default Chrome installations. The limiting factors are the mandatory user interaction (visiting/rendering the malicious page) and the technical difficulty of turning a Views use-after-free into a reliable out-of-sandbox code-execution chain; no special non-default configuration is required, which is consistent with the SSVC 'total' technical impact.

The signals conflict in an informative way. CVSS is severe (9.6: AV:N/AC:L/PR:N/UI:R, Scope Changed, full C/I/A) and SSVC rates Technical Impact as 'total,' consistent with a sandbox-escaping RCE. However, SSVC also records Exploitation: none and Automatable: no, EPSS is low (0.33%, 25th percentile), there is no CISA KEV listing, and no known POC. The UI:R requirement (a victim must open a malicious page) and the practical difficulty of weaponizing a Views use-after-free into a reliable sandbox escape explain the low near-term exploitation probability despite the high CVSS. This is a high-severity, patch-promptly issue because of Chrome's ubiquity and the total technical impact, but it is not currently an actively-exploited emergency; the realistic risk is opportunistic drive-by compromise rather than mass automated exploitation.

An attacker hosts a crafted HTML page (or injects one via a malicious ad or compromised site) and lures a victim running a vulnerable Chrome build to visit it. The page triggers the use-after-free in Views, corrupts heap memory to gain code execution, and chains the primitive to escape the sandbox and run arbitrary code with the browser process's privileges. No public exploit is known, and the AC:L/UI:R profile means exploitation is technically low-complexity but requires the victim to open the page.