Google Chrome EUVD-2026-65883

The target must be running Google Chrome prior to 152.0.7977.65 on a desktop platform. Mandatory user interaction (UI:R per CVSS) is the central limiting condition: the victim must be socially engineered into installing a crafted Chrome extension - no drive-by or passive exploitation path is indicated. No authentication or elevated privileges are required on the attacker's side (PR:N). No special server-side configuration or non-default Chrome deployment mode is required for the vulnerability to be present. Exploitation is limited to integrity impact only; confidentiality and availability are not compromised. Environments with enterprise extension install policies (allowlist enforcement) are not exploitable via this vector, as the crafted extension cannot be installed.

The CVSS base score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N reflects a network-accessible flaw requiring no privileges but demanding mandatory user interaction (UI:R), which is the critical limiting factor. The attack chain depends entirely on social engineering to induce a user to install a malicious extension - this substantially reduces the likelihood of opportunistic or automated mass exploitation. Impact is bounded to integrity only (I:L), with no confidentiality or availability consequences confirmed. EPSS at 0.21% (11th percentile) is consistent with this profile and does not suggest active or widespread exploitation. The absence of a CISA KEV listing and no known POC further support treating this as a routine patch-cycle priority rather than an emergency response item. The social engineering prerequisite also means technical mitigations (enterprise extension policies) can meaningfully reduce exposure even before patching.

An attacker hosts a website or phishing page that convinces a target running Chrome prior to 152.0.7977.65 to install a crafted Chrome extension - for example, by impersonating a legitimate productivity tool. Once installed, the malicious extension exploits the incorrect authorization logic in Chrome's Extensions subsystem to bypass system access restrictions it would normally be denied, achieving unauthorized integrity impact on the victim's system. No public exploit code has been identified at time of analysis, so exploitation currently requires a custom-crafted extension and social engineering capability.