Google Chrome EUVD-2026-65831

Exploitation requires a victim running Google Chrome prior to 152.0.7977.65 to navigate to an attacker-controlled HTML page - the description explicitly names social engineering as the delivery mechanism. The CVSS UI:R metric confirms mandatory active user interaction; there is no drive-by or passive exploitation pathway. The vulnerability is confined to the FileSystem API component, meaning the crafted page must invoke FileSystem-related functionality to trigger the authorization flaw. No attacker-side authentication is required (PR:N), but the social engineering delivery step limits exploitability compared to fully remote, zero-interaction attacks. The unscopped impact (S:U) restricts consequences to the Chrome process context and does not extend to cross-origin or system-wide scope changes.

The CVSS 6.5 score reflects a network-delivered, low-complexity attack with no privilege requirement but mandatory user interaction (UI:R), producing high integrity impact and no confidentiality or availability effect. The social-engineering prerequisite - convincing a user to visit a crafted HTML page - is the primary friction point and a realistic barrier to mass exploitation. EPSS at 0.38% (31st percentile) is low, consistent with the UI:R constraint; this is not a scan-and-exploit-style vulnerability. There is no CISA KEV listing and no POC is identified in the input data, so no public weaponization is confirmed at time of analysis. The integrity-only impact (C:N) means credential theft or data exfiltration is not directly enabled, but unauthorized file writes could support persistence mechanisms or data corruption on the victim host. Overall, this is a genuine but not emergency-tier risk: the fix is available, auto-update covers most consumer Chrome installs, and enterprise fleet patching to 152.0.7977.65 through normal update cycles is the appropriate response.

An attacker crafts a malicious HTML page that triggers the FileSystem authorization flaw and distributes it via a phishing email or compromised website targeting Chrome users. A victim running Chrome prior to 152.0.7977.65 visits the page; the crafted page exploits the incorrect authorization logic to write or modify files in filesystem locations that should be restricted by the browser sandbox. No POC has been identified in the available data, so precise exploitation mechanics are inferred from the CVSS vector and CWE-863 root cause.