Google Chrome EUVD-2026-65887

Exploitation requires only that the victim visit an attacker-controlled HTML page using a vulnerable version of Google Chrome (prior to 152.0.7977.65) - no special Chrome configuration, enabled features, or victim-side privileges are required, consistent with AV:N/AC:L/PR:N in the CVSS vector. The sole limiting prerequisite is user interaction: the victim must actively navigate to the malicious page (UI:R), making social engineering, phishing, or malvertising the necessary delivery mechanism. The scope is unchanged (S:U), reflecting that exploitation is confined to the Chrome renderer sandbox - the attacker does not automatically gain OS-level access. Full host compromise is limited by Chrome's sandbox architecture and would require a separate chained sandbox escape exploit not described in this CVE. All desktop platforms running unpatched Chrome are equally exposed with no platform-specific conditions noted.

The CVSS 8.8 score is driven by network accessibility (AV:N), low complexity (AC:L), no required privileges (PR:N), and full confidentiality, integrity, and availability impact within the affected scope - metrics that accurately reflect how easy it is to deliver the exploit. However, several signals temper the urgency: EPSS at 0.39% (31st percentile) is low, indicating the broader security community has not observed widespread exploitation attempts; KEV listing is absent, so active exploitation is not confirmed by CISA; and Google's own Chromium severity rating is Medium rather than Critical, consistent with the sandbox constraint limiting direct host compromise. There is a meaningful gap between the NVD 8.8 and vendor Medium ratings that defenders should factor in - sandbox-confined execution is a substantially lower-impact outcome than full host RCE, and full compromise requires a chained sandbox escape. The attack complexity is genuinely low for delivering the initial exploit, so even a well-resourced attacker targeting specific individuals could realistically weaponize this - but mass exploitation is not evidenced by current EPSS data. Overall: patch promptly, but triage below KEV-listed or sandbox-escape-capable vulnerabilities.

An attacker registers or compromises a domain and serves a crafted HTML page containing malicious JavaScript engineered to trigger the V8 stack buffer overflow. A victim using unpatched Chrome visits the page - perhaps via a phishing link, malvertising, or a compromised legitimate site - causing the overflow to corrupt stack control data and redirect V8 execution to attacker-controlled code within the Chrome renderer sandbox. To achieve full host compromise, the attacker would need to additionally exploit a separate sandbox escape vulnerability, making this a likely first stage in a chained exploit rather than a standalone full-system compromise.