Google Chrome EUVD-2026-65825

Two distinct preconditions are both required: (1) the attacker must have already compromised the Chrome renderer process through a separate, independent exploit - this vulnerability is explicitly not an initial-access vector and is only reachable from within an already-corrupted renderer context; and (2) the victim user must actively navigate to or load a crafted HTML page (UI:R per CVSS). No non-default Chrome configuration is required to reach the vulnerable Blink code path once a renderer compromise is in place. The dominant limiting factor is the mandatory prior-renderer-compromise precondition, which requires the attacker to possess and successfully detonate a separate renderer exploit before this vulnerability becomes useful. Chrome versions 152.0.7977.65 and later are not affected.

The CVSS 7.5 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately captures the dual-gated threat model: full renderer-scope compromise is possible, but only after a prior renderer exploit is already in play (AC:H) and user interaction occurs (UI:R). These preconditions substantially narrow the realistic attacker pool to sophisticated actors capable of chaining two distinct browser exploits. EPSS at 0.28% (20th percentile) is consistent with no observed mass exploitation and corroborates the low-probability-but-high-impact profile. No CISA KEV listing exists, and no public POC has been identified. Chromium's own Medium severity rating - lower than NVD's High - reflects the team's view that the mandatory renderer pre-compromise is a dominant constraint. There is no signal conflict between EPSS, KEV status, and Chromium severity; all three agree this is a theoretical second-stage risk rather than an immediate widespread threat. Prioritization should focus on ensuring Chrome is updated to 152.0.7977.65 rather than treating this as an emergency response requiring compensating controls.

An attacker who has already leveraged a separate vulnerability to compromise a Chrome renderer process - for example, a V8 JavaScript engine memory corruption bug - serves a crafted HTML page that triggers the Blink heap buffer overflow. The overflow corrupts heap memory within the renderer, redirecting native code execution to attacker-controlled shellcode running inside the Chrome sandbox. This renderer-level code execution would then typically be chained with a subsequent sandbox escape exploit to achieve full system compromise.