Google Chrome EUVD-2026-65851

Exploitation requires that the victim actively navigate to a crafted HTML page - user interaction is mandatory and confirmed by UI:R in the CVSS vector. The attacker requires no account, credentials, or prior access to the victim's browser or network (PR:N, AV:N). The victim must be running Google Chrome prior to version 152.0.7977.65 on any supported platform. No special non-default Chrome configuration or feature flag is identified as a prerequisite. Limiting factors include the requirement for social engineering to deliver the crafted page, the absence of integrity or availability impact, and the confined confidentiality exposure (C:L), which means practical exploitation yields only partial cross-origin data rather than full session compromise.

The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating a network-reachable flaw requiring no attacker privileges and low attack complexity, but constrained by a mandatory user interaction (UI:R) and a limited confidentiality impact with no integrity or availability consequences. EPSS is 0.29% at the 21st percentile, consistent with a medium-severity browser bug that requires social engineering to deliver and yields only partial data exposure. CVE is not listed in the CISA KEV catalog. No POC is referenced in available intelligence. The combination of low EPSS, no KEV, UI:R requirement, and C:L-only impact classifies this as a real but lower-priority browser vulnerability - meaningful for high-assurance environments handling sensitive cross-origin data, but not an emergency for standard enterprise patch cycles. The 'Authentication Bypass' tag is consistent with the origin-policy bypass nature but should not be conflated with authentication credential bypass.

An attacker hosts a crafted HTML page on an attacker-controlled domain and delivers its URL to a target via phishing, malvertising, or social engineering. When the victim navigates to the page in an unpatched Chrome browser, the malicious page exploits the authorization flaw in the Navigation subsystem to read limited data from a cross-origin context - for example, inferring user session state or partial content from a same-browser tab or frame. No public proof-of-concept exploit is referenced in available intelligence.