Google Chrome EUVD-2026-65879

The attacker must deliver a crafted HTML page and induce the target user to open it in a vulnerable Chrome browser - active user interaction (UI:R) is required, limiting fully automated exploitation. No attacker-side authentication or elevated privileges are required (PR:N). The vulnerability is present in default Chrome configurations with no non-standard feature or setting needed; however, exploitation is constrained to users running Chrome versions prior to 152.0.7977.65. Auto-update significantly shrinks the exploitable population over time. Exploitation is scoped to confidentiality loss within the browser's security boundary (S:U); lateral movement or code execution are not implied by available data.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a network-reachable, low-complexity attack requiring no attacker privileges but dependent on user interaction (visiting a crafted page), with confidentiality impact confined to the vulnerable browser session. Real-world risk is moderated significantly by the EPSS score of 0.32% (24th percentile), signaling that exploitation is currently uncommon relative to other vulnerabilities. There is no KEV listing and no public proof-of-concept identified at time of analysis. The absence of integrity or availability impact limits the worst-case outcome to information disclosure rather than full compromise. Chrome's auto-update mechanism further narrows the exploitable window for most users. The primary risk lies with managed or enterprise environments where Chrome updates are delayed or controlled, and with users who have disabled auto-update. The tag 'Authentication Bypass' in EUVD metadata loosely reflects the authorization bypass nature but should not be conflated with authentication-layer weaknesses; this is strictly an authorization control failure within WebProtect.

An attacker hosts a crafted HTML page on a controlled server and lures a Chrome user to visit it through phishing, malvertising, or a compromised website. Upon page load, the malicious content triggers the incorrect authorization logic in WebProtect, causing Chrome to improperly permit access to sensitive information that should be protected by cross-origin or security boundary controls, which is then exfiltrated to the attacker. No public proof-of-concept is available at time of analysis, but the low attack complexity (AC:L) and absence of required attacker privileges make this scenario technically straightforward once the authorization bypass mechanism is understood.