Google Chrome EUVD-2026-65891

Exploitation requires that the victim use a Google Chrome version prior to 152.0.7977.65 and navigate to an attacker-controlled HTML page - user interaction (UI:R) is the primary limiting condition. No authentication or account on the target system is required from the attacker's side (PR:N per the CVSS vector). The scope is unchanged (S:U), meaning impact is confined to the Chrome browser process and does not extend to OS-level compromise. Exploitation is limited strictly to confidentiality - no modification of data or denial of service is achievable through this flaw. The specific data accessible via the WebProtect bypass is not enumerated in publicly available references; the Chromium issue tracker entry is likely restricted, so the precise sensitive information category is inferred from the CVSS C:H rating rather than confirmed by vendor disclosure.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N describes a network-reachable, low-complexity flaw requiring no attacker privileges and only routine user interaction (visiting a page), with high confidentiality impact confined to the browser scope. Despite these characteristics, the EPSS score of 0.27% at the 19th percentile is notably low for a Chrome-class vulnerability, suggesting limited observed exploitation activity in practice. The vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog and no public exploit code has been identified at time of analysis. Real-world risk is meaningful given Chrome's near-universal enterprise and consumer deployment, but the combination of required user interaction, low EPSS, and no KEV listing positions this as a timely - rather than emergency - patch priority. The CVSS confidentiality signal is credible and aligns with the WebProtect authorization bypass mechanism, but the exact category of sensitive information exposed is not independently confirmed in available references.

An attacker hosts a specially crafted HTML page designed to trigger the incorrect authorization logic in Chrome's WebProtect component, then delivers a link to the target via phishing email, malvertising, or a compromised website. The victim opens the link in an unpatched Chrome browser; the crafted page bypasses WebProtect's authorization checks and reads sensitive browser-accessible information, which is returned to the attacker. No public exploit code is known at time of analysis, but the low attack complexity (AC:L) indicates exploitation does not require advanced techniques once the bypass mechanism is understood.