Google Chrome EUVD-2026-65806

Exploitation requires the victim to visit a crafted HTML page in Google Chrome on Windows - a single user interaction with no authentication required, confirmed by the CVSS vector PR:N/UI:R. The vulnerability is explicitly Windows-platform-specific per the CVE description; Chrome on macOS and Linux is not confirmed affected. Impact is bounded to code execution inside Chrome's renderer sandbox (S:U), meaning successful exploitation yields sandboxed code execution rather than direct host-level access; a separate sandbox escape primitive would be required for full system compromise. No non-default configuration, special feature flag, or authenticated session is required to trigger the vulnerability - any user browsing to a malicious page with an unpatched Chrome on Windows is potentially exposed.

The CVSS 8.8 score with AV:N/AC:L/PR:N/UI:R reflects a network-exploitable flaw requiring only a single user interaction, which is a realistic and low-friction threat model for browser vulnerabilities delivered via phishing or malvertising. However, several signals significantly moderate urgency: the stated impact is arbitrary code execution inside the Chrome renderer sandbox (S:U, Scope Unchanged), not a full host-level compromise - a secondary sandbox escape primitive would be required to achieve that. EPSS at 0.25% (16th percentile) is markedly low for a vulnerability of this CVSS severity, indicating that exploitation has not been operationalized at scale as of analysis time. There is no CISA KEV listing and no confirmed public exploit code, making this a high-severity-but-currently-low-exploitation-probability issue. The realistic risk is best framed as: Chrome's ubiquitous deployment and the low barrier to delivery (a webpage visit) make this an attractive exploit-development target, and the risk of chaining with a separate sandbox escape is non-trivial, but as a standalone vulnerability the immediate real-world impact is sandboxed code execution rather than system compromise.

An attacker crafts a malicious webpage containing HTML or WebGL content engineered to trigger the out-of-bounds write in Chrome's ANGLE graphics layer during rendering. A Windows user running an unpatched Chrome version is lured to the page via phishing email or malvertising; upon page load, the memory corruption executes attacker-controlled shellcode inside the Chrome renderer sandbox process. No public exploit or proof-of-concept code has been identified at time of analysis, but the low attack complexity and single-user-interaction prerequisite make this a plausible target for exploit development and potential chaining with a sandbox escape.