Google Chrome EUVD-2026-65808

The sole triggering condition is that a user running a vulnerable version of Google Chrome (prior to 152.0.7977.65) visits a crafted HTML page, requiring active user interaction (UI:R). No authentication, account, or special privilege is required from the attacker's perspective. No non-default configuration is specified as a prerequisite. Exploitation is bounded by the Chrome sandbox: code execution is explicitly described as occurring inside the sandbox, meaning full host compromise would require a separate sandbox-escape vulnerability chained after this one. Automatable mass exploitation is not feasible per SSVC, as the user-interaction requirement prevents purely network-driven exploitation without social engineering. The vulnerability is platform-agnostic across Chrome desktop installations.

The CVSS 8.8 score reflects a dangerous attack profile: network-reachable, low complexity, no privileges required, and high impact across all three pillars, with only user interaction (UI:R) serving as a barrier. However, several signals temper the urgency relative to the raw score. EPSS places exploitation probability at just 0.33% (25th percentile), indicating low observed or predicted exploitation activity - well below thresholds typically associated with widespread weaponization. The SSVC assessment corroborates this: exploitation status is listed as 'none' and the vector is not automatable, meaning mass-exploitation campaigns are not yet observed or structurally feasible without per-target phishing. The technical impact rating of 'total' is consistent with high C/I/A CVSS metrics but applies only within the sandbox boundary per the description. There is no KEV listing. In aggregate, this is a genuine high-priority patch target for any Chrome deployment - even a well-resourced IT team managing a few hundred endpoints should treat this as urgent scheduled patching - but the absence of in-the-wild exploitation and low EPSS score suggest immediate emergency response is not yet warranted in most environments. The discrepancy between CVSS severity and EPSS percentile is noted: this may reflect early-stage disclosure before weaponization rather than a permanently low-risk issue.

An attacker hosts a malicious web page containing crafted HTML or JavaScript designed to trigger the use-after-free condition in Chrome's Platform component, then lures a target user to visit it via phishing, malvertising, or a watering-hole attack. Upon page load in a vulnerable Chrome version, the freed memory object is accessed, corrupting the heap in a way the attacker controls, resulting in arbitrary code execution within the Chrome renderer sandbox. No public proof-of-concept exploit has been identified at time of analysis, but use-after-free primitives in Chromium are well-understood by advanced threat actors and capable researchers.