Google Chrome EUVD-2026-65813

Exploitation requires the victim to be socially engineered into installing a specific attacker-crafted Chrome extension - the CVSS UI:R metric and the description's "leveraging social engineering ... via a crafted Chrome extension" make user-driven extension installation the concrete prerequisite. No prior authentication to the target is needed (PR:N), and the attack is network-reachable (AV:N) with low complexity (AC:L), but it will not fire against a user who does not install the malicious extension. Exploitation is limited to Chrome desktop versions before 152.0.7977.65; patched builds and environments that block user extension installation via enterprise policy are not exploitable through this path.

The signals are mixed and should be weighed together rather than read off the 9.6 CVSS alone. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) is severe primarily because of the sandbox-escape scope change and full triad impact, but it explicitly requires user interaction (UI:R) - the victim must be socially engineered into installing a malicious extension, which is a meaningful real-world barrier. EPSS is low at 0.28% (20th percentile), the vulnerability is not on CISA KEV, and there is no public exploit identified at time of analysis, so this is not evidence of active or widespread exploitation. That said, given Chrome's near-universal deployment, the practical guidance is that any operator - from a large enterprise fleet to even a mid-sized municipal IT team in zabrze - should patch promptly on the normal Chrome auto-update cadence, but this is a high-severity-with-mitigating-conditions issue rather than a confirmed under-attack emergency. The main uncertainty is exploit maturity: memory-corruption bugs in Chrome are attractive targets and can be weaponized later, so the low EPSS reflects present, not future, risk.

An attacker publishes or distributes a crafted Chrome extension and lures a targeted user - via a phishing page, fake tool, or social-engineering pretext - into installing it. Once loaded, the extension triggers the use-after-free in the Extensions component to corrupt memory and execute code outside the browser sandbox, giving the attacker code execution on the host. No public exploit is identified at time of analysis, and the attack hinges on the victim completing the extension installation.