Google Chrome EUVD-2026-65824

User interaction is mandatory - the victim must actively browse to a crafted HTML page (UI:R). The attack is only meaningful if the victim has sensitive data stored in Chrome's Autofill feature; users with empty autofill profiles expose nothing. High attack complexity (AC:H) indicates that reliable, repeatable data extraction requires precise engineering of the side-channel measurement - controlled timing, specific field configurations, or multiple probing interactions. No authentication is required of the attacker. Exploitation is limited to information disclosure only: no integrity or availability impact is possible through this vector. The flaw is not triggered by default browser activity but specifically by the attacker-controlled page's form element construction.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N encodes two key constraints that substantially limit real-world risk despite the High confidentiality rating: attack complexity is High (precise timing or measurement conditions required) and user interaction is mandatory (victim must browse to the attacker-controlled page). The EPSS score of 0.31% at the 23rd percentile reflects low community-assessed exploitation probability. There is no CISA KEV listing and no public exploit code identified at time of analysis. Chromium's own internal severity rating is Medium, consistent with these constraints. In practice, reliable extraction of meaningful autofill data via a side-channel requires non-trivial engineering effort, placing this within reach of targeted attackers or researchers but not opportunistic mass exploitation. Organizations on standard Chrome auto-update schedules will be remediated quickly; those with managed, update-lagging fleets or high-value user populations face the most residual exposure.

An attacker crafts an HTML page with form fields engineered to trigger measurable autofill behavior discrepancies and distributes a link via phishing or malicious advertising. When a Chrome user visits the page, the attacker's JavaScript measures timing or layout differences as Chrome evaluates autofill candidates, allowing inference of what sensitive data categories - such as saved payment cards or home addresses - the victim has stored. No public proof-of-concept exists; this attack requires precise measurement instrumentation and is more suited to targeted surveillance than mass exploitation.