Google Chrome EUVD-2026-65904

Exploitation requires the attacker to be capable of delivering crafted network traffic to the victim's Chrome instance during an active or initiated SignIn operation - implying either a network-adjacent position (e.g., same LAN, rogue AP) or the ability to influence traffic in transit. The CVSS AC:H rating confirms that race conditions, specific timing, or precise packet crafting are required; this is not a fire-and-forget attack. Chrome's SignIn feature must be in use (i.e., the user must have or be initiating a Google account sign-in). No attacker authentication is required (PR:N), and no user interaction beyond normal browsing is needed (UI:N). Exploitation is bounded to confidentiality impact only - no code execution or data modification is possible through this vector alone.

The CVSS base score of 5.9 (Medium) is primarily driven by the High confidentiality impact (C:H) and network attack vector (AV:N), but the High complexity rating (AC:H) is the critical moderating factor - exploitation requires the attacker to engineer specific network conditions, likely involving traffic interception or manipulation during an active SignIn session. EPSS at 0.21% (11th percentile) strongly corroborates that exploitation is not currently occurring at scale; even a mid-sized municipal IT team in tczew should treat patch deployment as routine hygiene rather than emergency response. There is no CISA KEV listing and no known public proof-of-concept. The absence of integrity or availability impact (I:N, A:N) bounds the damage to information disclosure only. The overall risk profile is moderate-low in practice: the vulnerability is real and the confidentiality impact is significant if exploited, but the attack complexity is a meaningful barrier to casual or automated exploitation.

An attacker positioned to observe or manipulate a victim's network traffic - such as on a shared network segment, a rogue Wi-Fi access point, or via a compromised network device - sends crafted packets timed to interact with Chrome's SignIn flow while the user authenticates with a Google account. The crafted traffic triggers the information leak, exposing sensitive data such as session tokens or identity artifacts that the attacker captures for subsequent account access or session hijacking.