Google Chrome EUVD-2026-65905

Exploitation requires the victim to actively navigate to or open a crafted HTML page, meaning user interaction is a hard prerequisite (UI:R in the CVSS vector). The attacker requires no authentication and no account on the target system (PR:N). No special non-default Chrome configuration is required - any default desktop Chrome installation prior to 152.0.7977.65 is susceptible once the user visits the attacker's page. Exploitation is limited to a low integrity impact with no confidentiality or availability breach (C:N/I:L/A:N), and the scope is contained to the vulnerable system without privilege escalation beyond the browser context (S:U). Chrome's sandboxing architecture further constrains post-exploitation lateral movement.

The CVSS 3.1 base score of 4.3 (Medium) is driven by a network-accessible vector with low complexity and no required privileges (AV:N/AC:L/PR:N), tempered by mandatory user interaction (UI:R), unscoped impact (S:U), and a low integrity impact with no confidentiality or availability breach (C:N/I:L/A:N). EPSS at 0.23% in the 13th percentile strongly corroborates low exploitation likelihood - this is not a widely targeted class of flaw at the time of analysis. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified from the available intelligence. The practical risk is further bounded by Chrome's auto-update mechanism, which rapidly reduces the exposed population once a stable channel update ships. This is a real but low-urgency issue: organizations with managed browser fleets should prioritize the update in normal patch cycles rather than emergency response.

An attacker hosts a crafted HTML page on an attacker-controlled website and socially engineers a target Chrome user into navigating to that page. Upon page load, the malicious HTML triggers an incorrect authorization check in Chrome's Network component, causing the browser to bypass system-level access restrictions it would normally enforce. The result is a low-integrity impact - the attacker may cause unauthorized writes or modifications scoped to the vulnerable system, without gaining read access to sensitive data.