Google Chrome EUVD-2026-65810

Exploitation requires the victim to open attacker-controlled HTML in a vulnerable Chrome build (prior to 152.0.7977.65) that reaches the ANGLE graphics path - in practice a page rendering WebGL/graphics content that triggers the freed-object reuse. The gating limiting factors are: user interaction is mandatory (UI:R - the victim must navigate to or load the malicious page; this is not a zero-click network exploit), and the target must be an unpatched Chrome version. No authentication or prior privileges are needed (PR:N). Exploitation is not automatable per CISA SSVC (Automatable: no) and no public exploit exists, so realistic risk is driven by social-engineering delivery to unpatched clients rather than mass scanning.

The signals are mixed but lean toward high real-world priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated attack whose only gate is user interaction (visiting a page), with a scope change reflecting escape from the sandbox to full host code execution. Counterbalancing this, EPSS is low (0.41%, 34th percentile) and CISA's SSVC records Exploitation: none and Automatable: no, though Technical Impact is total. There is no KEV listing and no evidence of a public POC. Net: a genuine high-severity RCE that warrants prompt patching, but current data indicates no active or automated exploitation - urgency derives from impact potential plus Chrome's ubiquity, not confirmed in-the-wild use. The description's phrase 'outside the sandbox' is consistent with the S:C scope change.

An attacker hosts a malicious web page containing crafted WebGL/graphics content and lures a victim to it via a phishing link, malicious ad, or compromised site. Rendering the page triggers the use-after-free in ANGLE, and through heap grooming the attacker escapes the browser sandbox to execute arbitrary code on the victim's machine. Exploitation requires user interaction (opening the page) but no authentication; no public POC is identified at time of analysis.