Google Chrome EUVD-2026-65818

User interaction is required - the victim must actively visit or be redirected to a crafted HTML page controlled by the attacker (UI:R per CVSS). No attacker authentication or privilege is required (PR:N). No special server-side configuration is needed; the vulnerability manifests in Chrome's GPU subsystem during normal page rendering. Exploitation is limited to Chrome versions prior to 152.0.7977.65 on any supported platform. The scope is unchanged (S:U), meaning the data leak is bounded to content accessible within the same browser session across origins rather than escaping the browser process entirely. The primary limiting factor is the need to deliver a crafted page to a real user, making mass automated exploitation difficult without a delivery mechanism such as malvertising or phishing.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable attack requiring no privileges but dependent on user interaction (UI:R), with confidentiality impact limited to Low (C:L) and no integrity or availability impact. The unchanged scope (S:U) bounds the leak to within the browser process. EPSS at 0.22% in the 13th percentile indicates very low current exploitation activity - well below the threshold typically associated with active campaigns. No public exploit code has been identified, and the vulnerability is absent from the CISA KEV catalog. Despite these low signals, cross-origin data leaks in browsers are qualitatively serious: even a partial leak of GPU-buffered content can expose session cookies, authentication tokens, or private rendered data from co-loaded origins. The practical risk is tempered by the UI:R requirement, meaning mass exploitation requires a social engineering or malvertising delivery mechanism. Overall, organizations should treat this as a routine patch-cycle priority rather than an emergency, though enterprises running unmanaged or auto-update-disabled Chrome deployments warrant closer attention.

An attacker crafts a malicious HTML page that triggers GPU rendering operations designed to read cross-origin texture or buffer data retained from other origins in the GPU's memory. When a victim is social-engineered or redirected to visit the page (via phishing, malvertising, or a compromised site), the crafted page silently exfiltrates fragments of data - potentially including rendered content from banking or email tabs open in the same browser session. No public proof-of-concept has been identified at time of analysis.