Google Chrome EUVD-2026-65842

The victim must be using an unpatched version of Google Chrome (prior to 152.0.7977.65) and must actively visit a crafted HTML page controlled by the attacker - user interaction is required and confirmed by UI:R in the CVSS vector. The attacker requires no authentication or privileges (PR:N). For meaningful data exfiltration, the victim must also hold an active authenticated session to the cross-origin target that contains data of value; without this, the side-channel reveals little of consequence. The vulnerability is not exploitable server-side, not triggered by passive browsing of benign sites, and does not affect non-SVG content paths. No special Chrome configuration or feature flag is documented as required or as a mitigating setting.

The CVSS 4.3 Medium rating with AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N is internally consistent: the vulnerability is network-reachable with no complexity or privilege barrier for the attacker, but mandates active user interaction and delivers only low confidentiality impact with no integrity or availability consequence. EPSS at 0.37% (30th percentile) strongly corroborates a low current exploitation probability, consistent with the absence of any CISA KEV listing or publicly available proof-of-concept code. The practical damage ceiling is limited - side-channel leakage via SVG observable discrepancy typically requires repeated, precise measurements, user presence in the browser, and the victim holding an authenticated session to a target origin of value. This is not a trivially weaponizable flaw; real-world exploitation demands a targeted, well-resourced attacker. Organizations should patch via normal patch cycle cadence rather than treating this as an emergency. No conflicting signals are present between CVSS, EPSS, and KEV data in this case.

An attacker hosts a crafted HTML page that embeds cross-origin SVG resources from a target origin (e.g., a banking portal or authenticated web app) and social-engineers the victim into visiting it while logged into that target. The page runs JavaScript that repeatedly triggers SVG rendering and measures observable discrepancies - timing differences, layout shifts, or error callbacks - to infer cross-origin data one bit or token at a time. No public proof-of-concept is known; the attack requires sustained victim presence and a session to the target origin.