Google Chrome EUVD-2026-65783

Exploitation requires the victim to actively visit a crafted HTML page controlled by the attacker (user interaction, UI:R in CVSS) - drive-by exploitation is not possible without this step. The attacker requires no authentication or elevated privileges (PR:N, AV:N). No non-default browser configuration or specific feature flag is stated as a prerequisite in the available data; any Chrome installation prior to 152.0.7977.65 appears to be in scope. Exploitation is limited by: mandatory user interaction (the victim must load the attacker's page); partial confidentiality impact only (C:L - limited cross-origin data read, not full data exfiltration); no integrity or availability effect; and scope confined to the browser process (S:U, no system-level compromise). These factors reduce realistic risk compared to the browser's most severe vulnerability classes.

The CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N accurately reflects the bounded nature of this flaw: network-accessible and requiring no attacker authentication, but gated by mandatory user interaction (UI:R) and limited to partial confidentiality impact with no integrity, availability, or scope-change effects. EPSS at 0.24% (15th percentile) is substantially low, indicating minimal observed or predicted exploitation activity in the wild. The vulnerability is not listed in CISA KEV, and no public exploit code is identified in the provided data. Together, these signals indicate a real but lower-priority browser security boundary bypass - meaningful for environments where data isolation between web origins is critical (e.g., intranet apps co-browsed with public internet), but not an emergency for typical enterprise patch cycles. The unchanged scope (S:U) limits blast radius to the browser process itself.

An attacker crafts a malicious HTML page that triggers the incorrect authorization flaw in Chrome's Paint component, causing the browser to bypass same-origin checks for a targeted cross-origin resource. When a victim Chrome user visits the attacker's page - through a phishing link, malvertising, or a compromised third-party site - the page may read limited data from a cross-origin origin that policy should have blocked. No public exploit code has been identified at time of analysis, so exploitation currently requires independent vulnerability research or reverse-engineering of the patch.