Google Chrome EUVD-2026-65782

Two conditions must both be satisfied: (1) the attacker must have already achieved renderer process compromise - a significant prerequisite typically requiring a separate, chained browser vulnerability such as a V8 engine or IPC flaw; (2) the victim must actively visit or be redirected to a crafted HTML page that exercises the vulnerable FileSystem code path (UI:R). The renderer pre-compromise requirement limits exploitation to sophisticated, multi-stage attacks rather than opportunistic mass exploitation. AC:H in the CVSS vector reflects the additional constraint of reliably winning a timing-sensitive race condition. No non-default Chrome configuration or feature flag is required beyond the renderer compromise prerequisite. Exploitation is bounded to Chrome versions prior to 152.0.7977.65 on all platforms.

The CVSS 8.3 High score is driven by AV:N (web-delivered), S:C (full sandbox escape), and a C:H/I:H/A:H impact triad, but AC:H and UI:R meaningfully constrain realistic exploitability. Most critically, the description explicitly states a pre-compromised renderer is required - this is not a one-step exploit; it is the second link in a chain, typically following a separate V8 or IPC vulnerability. EPSS at 0.20% (10th percentile) corroborates low mass-exploitation probability. No CISA KEV listing and no identified POC further reduce urgency. This vulnerability is genuinely dangerous in the context of a sophisticated, chained browser exploit (as used in targeted attacks), but presents low opportunistic risk to the average user post-patch. The primary real-world priority is patching - no conflicting signals between data sources, though the absence of a POC or KEV listing means exploitation complexity may be higher than the CVSS score alone suggests.

An attacker targeting a specific user first delivers a separate browser exploit (e.g., a V8 JavaScript engine vulnerability) via a malicious or compromised website to achieve renderer process compromise. From that foothold, the attacker serves a crafted HTML page that repeatedly triggers Chrome's FileSystem component, racing the TOCTOU window until the race is won and a manipulated file handle passes sandbox validation. On success, arbitrary code executes at OS-level privileges outside the Chrome sandbox. No public exploit code has been identified at time of analysis, and reliably winning the race condition adds meaningful operational complexity.