Google Chrome EUVD-2026-65893

User interaction is required (CVSS UI:R) - the victim must navigate to or load attacker-controlled content in Chrome while the crafted network traffic is delivered. No attacker privileges are needed (PR:N). The vulnerability is specific to Chrome's TabGroups feature; while tab groups do not require explicit user configuration to be active (the feature is enabled by default in recent Chrome builds), the exploitation depends on the feature being present and the authorization path being triggered. Exploitation is limited by: the user interaction requirement (preventing fully automated network-based attacks), the confidentiality-only impact (no code execution or integrity modification possible via this flaw alone), and the unscoped impact (S:U, contained to the browser process). Chrome 152.0.7977.65 and later are not affected.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a Medium-severity information disclosure with no authentication barrier for the attacker but requiring victim user interaction, which limits automatable exploitation. Despite High confidentiality impact, scope is unscoped (S:U) meaning impact is contained to the browser process. EPSS of 0.20% at the 10th percentile is notably low and indicates this vulnerability has not attracted significant opportunistic exploitation activity. There is no CISA KEV listing and no known public proof-of-concept. The Chromium team's own Medium severity rating aligns with this profile. On balance, this is a real but low-urgency issue: it warrants patching on the next normal update cycle, but organizations without near-term Chrome update capabilities should not treat it as an emergency given the absence of active exploitation signals and the user-interaction prerequisite.

An attacker hosts a malicious web page or network endpoint that serves specially crafted HTTP traffic targeting the TabGroups authorization flaw. When a victim user with an affected Chrome version visits the attacker-controlled resource, the crafted traffic triggers the incorrect authorization check within the TabGroups component, causing Chrome to expose sensitive information - such as tab URLs, session identifiers, or page content from other tab groups - back to the attacker-controlled origin. No public proof-of-concept exists at time of analysis, but the low attack complexity (AC:L) suggests the technique is not mechanically difficult once the flaw is fully understood.