Google Chrome EUVD-2026-65791

Exploitation requires the victim to open an attacker-controlled HTML page in a vulnerable Chrome build (< 152.0.7977.65) with WebGPU/Dawn reachable - i.e., GPU-accelerated rendering and WebGPU support enabled, which is the default on supported hardware. The limiting factor is mandatory user interaction (UI:R): the attacker cannot trigger it without the user navigating to the page; there is no authentication requirement (PR:N, unauthenticated). Disabling WebGPU or hardware acceleration removes the prerequisite, and platforms/hardware where WebGPU is unavailable are not exposed via this path.

The signals partially conflict in the usual way for browser bugs: CVSS 3.1 is 9.6 Critical (AV:N/AC:L/PR:N/UI:R/S:C, full C:H/I:H/A:H) because a network-delivered page can escape the sandbox with no privileges, but EPSS is only 0.25% (16th percentile) and the bug is not on CISA KEV, indicating no observed mass exploitation yet. The one meaningful barrier is UI:R - the victim must open attacker-controlled content - which tempers the otherwise wormable-looking network vector. There is no SSVC record or POC in the provided data. Net: this is a genuine high-priority patch for any organization running Chrome (near-ubiquitous), driven by the severity and sandbox-escape nature rather than by evidence of current active exploitation. Treat the low EPSS as 'not yet weaponized publicly,' not as 'low impact.'

An attacker hosts a malicious web page (or serves it via a compromised ad or iframe) containing crafted WebGPU/Dawn calls, then phishes or otherwise entices a victim into visiting it. When the page loads, the malformed input passes the renderer's checks but corrupts state in the GPU process, giving the attacker code execution outside the renderer sandbox. No public exploit is identified at time of analysis, but the low attack complexity means a reliable exploit would be broadly effective once developed.