Google Chrome EUVD-2026-65900

Exploitation requires network-adjacent or man-in-the-middle positioning to deliver crafted HTTP/2 traffic to a vulnerable Chrome client (AC:H from CVSS vector). No authentication is required (PR:N) and no user interaction is needed beyond the browser processing normal-appearing network traffic (UI:N). No special Chrome configuration or non-default feature flag is documented as a prerequisite. Factors limiting exploitation: the high attack complexity (AC:H) requires the attacker to control or intercept the HTTP/2 connection path, ruling out trivial remote exploitation from an arbitrary internet position. Impact is confined to confidentiality - no integrity or availability compromise (I:N/A:N). Scope is unchanged (S:U), meaning the flaw does not break out of the browser process boundary per CVSS assessment.

The CVSS 5.9 score with AV:N/AC:H reflects a genuine but constrained threat: network-reachable with no authentication required, but high attack complexity limits opportunistic mass exploitation. EPSS of 0.20% at the 10th percentile is consistent with this - statistically, fewer than 1 in 500 CVEs at this percentile see active exploitation within 30 days. The vulnerability is not listed in CISA KEV, and no POC has been publicly identified. The C:H impact metric indicates potentially significant information disclosure if successfully triggered, but the AC:H constraint means exploitation likely requires network-adjacent positioning or protocol-level traffic crafting that elevates the bar for attackers. On balance, this is a patch-and-monitor issue rather than an emergency: prioritize patching Chrome in environments handling sensitive browsing sessions, but the combination of high complexity and low EPSS argues against treating this as a crisis-level response item.

An attacker with network positioning - for example, operating as a man-in-the-middle on a shared or controlled network segment - sends specially crafted HTTP/2 frames to a Chrome browser running a vulnerable version. The missing authorization check causes Chrome to disclose sensitive information (such as cross-origin data or session-related content) to the attacker-controlled endpoint without proper validation. The high attack complexity means the attacker must establish specific network preconditions before triggering the flaw; no public POC exists to lower this bar at time of analysis.