Google Chrome EUVD-2026-65822

Exploitation requires the victim to actively open an attacker-controlled crafted HTML page that exercises Chrome's FedCM code path (UI:R in the CVSS vector) - so user interaction via social engineering is the mandatory precondition and the primary limiting factor; there is no authentication requirement (PR:N) and no special server-side privilege. The affected component must be reachable, i.e. the victim is running a vulnerable Chrome build below 152.0.7977.65 with FedCM available (default in shipping Chrome). What limits real-world exploitation: the need to lure the user to the malicious page, the absence of any observed in-the-wild use (SSVC Exploitation: none, not in KEV), and the fact that it is not automatable (SSVC Automatable: no), meaning it cannot be trivially wormed across targets.

The signals partially conflict and should be weighed together rather than read from the 9.6 alone. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated bug with a scope change to sandbox escape - hence the Critical score - but it requires user interaction (visiting a malicious page), and Google itself rates the Chromium severity only High. Counterbalancing the high CVSS, EPSS is just 0.33% (25th percentile), CISA's SSVC marks Exploitation as 'none' and Automatable as 'no', it is absent from CISA KEV, and no public proof-of-concept is identified, so this is currently a serious-but-not-yet-exploited memory-corruption bug rather than one under active mass exploitation. That said, because Chrome is effectively everywhere and browser UAF sandbox escapes are historically chained into real exploits, any organization from a global enterprise down to a mid-sized municipal IT team should treat patching as urgent and not defer it on the strength of the low EPSS number. In short: high theoretical impact and huge install base, low observed exploitation today - prioritize the update but no evidence of an in-progress campaign.

An attacker registers or compromises a web page and entices a target to open it (phishing link, malicious ad, or watering-hole). The page invokes FedCM in a way that triggers the use-after-free, and with heap grooming the attacker gains code execution outside the Chrome sandbox on the victim's machine. No public exploit is identified at time of analysis, but the low attack complexity means weaponization is plausible once details circulate.