Google Chrome EUVD-2026-65788

Exploitation requires the victim to actively visit an attacker-controlled HTML page in an unpatched Chrome instance prior to version 152.0.7977.65 (UI:R per CVSS). The uninitialized resource condition is triggered client-side through crafted graphics API calls (e.g., WebGL) embedded in the page - no server-side infrastructure beyond web hosting is required. No authentication is required of the attacker. Limiting factors include: (1) victim must navigate to the malicious page, preventing fully passive exploitation; (2) impact is restricted to low confidentiality leakage (C:L) with no code execution, integrity modification, or availability impact; (3) scope is unchanged (S:U), so the attacker cannot escape Chrome's sandbox or pivot to the OS; (4) the specific data exposed depends on what GPU resources happen to be uninitialized at the time, making targeted data theft unreliable without precise timing.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a network-exploitable, low-complexity flaw requiring no privileges but needing victim interaction - a user must visit a malicious page. Impact is confined to low confidentiality leakage with no integrity or availability consequence and unchanged scope (S:U), meaning no renderer process escape is implied. EPSS at 0.40% places this in the 33rd percentile, indicating low near-term exploitation probability relative to the broader vulnerability population. There is no CISA KEV listing and no confirmed POC. The practical real-world risk is modest: the data leakage is cross-origin but limited in quantity (C:L), and mass exploitation is constrained by the UI:R requirement. This is a genuine privacy and security concern for high-value targets (credentials, tokens in GPU-resident content) but is not a priority compared to full-RCE browser bugs.

An attacker hosts a crafted HTML page containing JavaScript or WebGL code that deliberately triggers an ANGLE uninitialized resource allocation, then reads the residual GPU buffer contents before Chrome has a chance to zero them. When a victim using an unpatched Chrome version visits the attacker's page, data previously rendered or processed by a different origin - such as fragments of an authenticated banking session or OAuth token visible in a recently rendered iframe - could be partially exposed and exfiltrated to the attacker's server. No public exploit code is confirmed at time of analysis.