Google Chrome EUVD-2026-65862

Exploitation requires the victim to be running Google Chrome on any platform at a version prior to 152.0.7977.65, and to be induced via social engineering to navigate to an attacker-controlled crafted HTML page - user interaction (UI:R) is the mandatory and primary limiting prerequisite. No authentication, no elevated privileges, and no non-default configuration are required on the victim's system. The social engineering dependency is the most significant friction point limiting exploitation at scale: the attacker cannot silently exploit targets without some form of deliberate user action. No additional server-side or configuration-specific conditions are described in available data.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5 (Medium), reflecting a network-reachable, low-complexity attack with no required privileges but mandatory user interaction, yielding high confidentiality impact only. Despite C:H, real-world risk is tempered by several signals: EPSS of 0.22% at the 13th percentile indicates very low observed exploitation probability in practice; the vulnerability is absent from CISA KEV; and no public exploit code has been identified at time of analysis. The social engineering dependency (user must be lured to a crafted page) is a meaningful friction point. Chrome's ubiquitous deployment footprint is the primary amplifying factor - even a low-probability exploit against a massive user base warrants timely patching. This is best treated as a standard patch-cycle update rather than an emergency out-of-band response, given the absent KEV/POC signals.

An attacker crafts a malicious HTML page containing JavaScript that exploits the DOM information leak to extract sensitive data - such as cross-origin content, session tokens, or authentication material - from the victim's Chrome browser context. The attacker distributes the page via a phishing email or malvertising campaign to lure the target into clicking a link, satisfying the required user interaction. No public exploit code is known, but the conceptual technique is well-understood within the DOM security research community.