Google Chrome EUVD-2026-65894

Exploitation requires a victim user to visit an attacker-controlled HTML page using an unpatched Google Chrome desktop browser (any version prior to 152.0.7977.65). The CVSS vector (UI:R) confirms that user interaction is mandatory - the attacker cannot trigger the vulnerability without the user navigating to the crafted page. The CVSS vector (PR:N) confirms no authentication is required on the attacker's side; any remote party can host the malicious page. No non-default Chrome configuration or special feature enablement is required, as ANGLE is active in all standard Chrome installations. Limiting factors include: the mandatory user navigation step, Chrome's GPU process sandbox (which constrains the scope of memory accessible to web content), and the practical difficulty of reliably targeting specific cross-origin data from uninitialized GPU memory without causing a renderer crash.

The CVSS 6.5 Medium rating (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a credible information disclosure risk: network-accessible, no authentication barrier, and High confidentiality impact. However, UI:R is a meaningful limiting factor - the victim must actively navigate to a crafted page, ruling out fully automated opportunistic exploitation at scale. The EPSS score of 0.24% (15th percentile) strongly reinforces this: despite the High confidentiality sub-score, the current probability of real-world exploitation against a given target is low, and no CISA KEV listing or public POC exists to elevate urgency. The confidentiality impact is genuine - cross-origin GPU data exposure can yield session tokens, page content, or other in-memory browser data - but the absence of integrity or availability impact means this flaw alone does not enable code execution or service disruption. Standard patch-cycle remediation is appropriate; emergency out-of-band response is not supported by current threat intelligence signals.

An attacker hosts a crafted HTML page containing malicious WebGL or graphics-intensive JavaScript designed to trigger uninitialized ANGLE GPU resource reads. When a victim navigates to this page in an unpatched Chrome browser, the page causes ANGLE to read residual GPU memory from a prior cross-origin rendering context, potentially exposing content from another browser tab or session. No public proof-of-concept code is known at the time of analysis, making reliable exploitation in practice technically non-trivial.