Google Chrome EUVD-2026-65841

Prior compromise of the Chrome renderer process is an explicit prerequisite stated in the CVE description - this vulnerability functions as a second-stage exploit and cannot be leveraged independently without a separate renderer RCE or equivalent primitive. The victim must also interact with a crafted HTML page (UI:R per CVSS vector), introducing a social engineering or drive-by delivery requirement. The race condition targets the Web Workers API specifically; content security policies or environments that block Worker instantiation would mitigate this specific path. Limiting factors: the renderer compromise prerequisite confines exploitation to sophisticated multi-bug attack chains, user interaction is required, and no public exploit or KEV listing exists. No special non-default Chrome configuration is required beyond the default Workers-enabled browser state - any standard Chrome installation below 152.0.7977.65 with an already-compromised renderer is susceptible.

The official CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) understates practical attack complexity: the description explicitly requires prior renderer compromise, a substantial multi-exploit prerequisite not reflected in AC:L. This creates a meaningful inconsistency - the vector implies straightforward remote exploitation while the description constrains it to a second-stage chained attack. EPSS at 0.19% (9th percentile) confirms that exploitation has not been observed at scale, consistent with the elevated skill barrier. The vulnerability is not listed in CISA KEV and no public proof-of-concept exploit code is identified. In practice, the threat actor profile is limited to sophisticated adversaries capable of chaining a separate renderer RCE with this SOP bypass. The limited confidentiality impact (C:L) and absence of integrity or availability impact further constrain the damage ceiling. The chromium-labeled severity of Medium is appropriate.

An attacker first exploits a separate Chrome renderer process vulnerability to gain arbitrary code execution within the sandboxed renderer. From that position, they load a crafted HTML page that spawns a malicious Worker and triggers the TOCTOU race between origin validation and cross-origin data access, reading sensitive content (e.g., authentication tokens or financial data) from another origin the victim has open in the same browser session. No public proof-of-concept for this specific race condition is currently known.