Google Chrome EUVD-2026-65856

Exploitation requires the victim to be running Google Chrome for Android with a version below 152.0.7977.65 and to interact with a crafted HTML page - for example, by clicking a permission prompt triggered by the attacker. The social engineering requirement (UI:R per CVSS) is a meaningful limiting factor; purely passive drive-by exploitation is not possible. The vulnerability is Android-platform-specific and does not apply to Chrome on desktop operating systems. No authentication is required from the attacker's side (PR:N). The race condition must win the timing window, but with AC:L the CVSS assessment indicates this is not considered an exceptional constraint.

The CVSS 3.1 score of 4.3 (Medium) reflects a network-accessible, low-complexity attack requiring user interaction with no privileges needed and limited confidentiality impact. The EPSS score of 0.26% at the 18th percentile indicates that, statistically, exploitation in the wild is not currently widespread - the practical risk is moderate at most. No KEV listing and no public proof-of-concept have been identified, which further lowers urgency; even a mid-sized municipal IT team in gliwice would not need to treat this as an emergency response, though prompt patching remains the correct posture. The Android-specific scope also narrows the affected fleet to mobile Chrome deployments. The social engineering prerequisite (UI:R) means mass exploitation is unlikely without a targeted phishing campaign. The primary real-world risk is selective, targeted abuse where an attacker can reliably direct victims to a malicious page.

An attacker crafts a malicious HTML page that triggers a permission request dialog at a precise timing window to exploit the TOCTOU race condition in Chrome's permission enforcement on Android. The attacker distributes the page via phishing or a compromised ad network, socially engineering the victim into interacting with it (e.g., clicking an allow button). If the race condition fires, Chrome incorrectly permits the page to access content from a different web origin, potentially leaking limited data such as cookies or page content belonging to that origin.