Google Chrome EUVD-2026-65882

The victim must visit an attacker-controlled or compromised webpage using a vulnerable Chrome version prior to 152.0.7977.65 (UI:R is required - passive browse is sufficient, no additional download or executable interaction needed). The attacker requires no authentication and no privileges on the victim's system (PR:N). Exploitation is constrained to reading memory within the Chrome sandbox (S:U); it does not provide OS-level code execution or sandbox escape. The vulnerability affects default Chrome configurations with no special feature flag or non-default setting required. The primary limiting factors are: user must navigate to the attacker's page, and the disclosed memory is bounded to Chrome's sandbox process rather than the full host system.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5 Medium. Key signals: network delivery with no required privileges and low complexity are concerning, but the mandatory user interaction (UI:R) - visiting a crafted page - is a meaningful friction point. The S:U (Unchanged scope) confirms Chrome's sandbox prevents escape to the host OS, constraining the worst-case impact to data readable within the sandbox process. C:H indicates the attacker can recover meaningful data if exploitation succeeds. Counterbalancing the CVSS: EPSS at 0.34% (26th percentile) reflects low probability of real-world automated exploitation, there is no CISA KEV listing, and no public proof-of-concept has been identified. The net assessment is moderate priority - Chrome's ubiquity means large absolute attack surface, but the UI:R gate and sandbox containment reduce practical exploitability compared to a fully remote, no-interaction vector.

An attacker hosts a malicious webpage containing crafted HTML and JavaScript that exercises Chrome's Video processing path in a way that triggers the uninitialized resource read. When a victim browses to the page using a vulnerable Chrome version, the attacker's script can retrieve the uninitialized memory contents - potentially exposing data such as cached credentials, session cookies, or other sensitive in-memory browser data. No public proof-of-concept code has been identified at time of analysis.