Google Chrome EUVD-2026-65785

Exploitation requires that the victim actively navigate to an attacker-controlled HTML page in a vulnerable Chrome version (prior to 152.0.7977.65), satisfying the UI:R condition in the CVSS vector. No authentication or special account privileges are required (PR:N). The attack is network-delivered (AV:N) and does not require a non-default Chrome configuration - WebRTC is enabled by default in all standard Chrome installations. Exploitation is constrained to the Chrome sandboxed renderer process (S:U); achieving host operating system access would require a separate sandbox escape primitive not described in this CVE. Browsers not based on the Chromium WebRTC stack are not affected.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is high on paper: network-delivered, low complexity, no privileges required, and full impact within the sandbox. However, multiple signals dampen the immediate real-world urgency. EPSS sits at 0.33% in the 25th percentile - well below the threshold typically associated with active mass exploitation. SSVC rates Exploitation as 'none' and Automatable as 'no', consistent with EPSS. CISA KEV has not listed this CVE. The UI:R requirement means drive-by exploitation requires victim navigation to a malicious page, reducing automation potential. The S:U scope boundary (no scope change) confirms that successful exploitation yields code execution only within Chrome's sandboxed renderer process, not the host OS - a second-stage sandbox escape would be required for full system compromise. Taken together, this is a credible but currently low-priority threat: patching is the correct action, but emergency out-of-band response is not warranted absent a shift in exploitation signals.

An attacker hosts a malicious web page containing crafted WebRTC session negotiation or media-stream handling logic designed to trigger a use-after-free condition in Chrome's WebRTC implementation. When a victim browses to the page - for example, via a phishing link or a compromised advertisement - the UAF is triggered during media processing, allowing the attacker to execute arbitrary code within Chrome's sandboxed renderer process. No public exploit code has been identified at time of analysis, and a full sandbox escape would require chaining a second vulnerability to achieve host-level impact.