Google Chrome EUVD-2026-65909

User interaction is required - the victim must open or process a crafted file within the Chrome browser (UI:R per CVSS vector). The vulnerability is located specifically in Chrome's Passwords feature, so that subsystem must be active (it is enabled by default in standard Chrome installations). No authentication or existing session privileges are required from the attacker (PR:N). Exploitation is limited to integrity impact only; there is no confidentiality or availability impact per CVSS. Limiting factors include the mandatory user interaction step (the victim must open the crafted file), the low integrity ceiling, and the lack of scope change (S:U, meaning compromise does not propagate to other system components). Non-default configurations or specific platform deployments are not identified as prerequisites beyond a standard Chrome desktop install prior to 152.0.7977.65.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable vector (AV:N), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R) and limited scope (S:U) with integrity-only impact (I:L). These metrics are internally consistent with a social-engineering or drive-by file delivery scenario. EPSS at 0.36% (29th percentile) is low, indicating the broader security community does not currently assess this as likely to be exploited at scale in the near term. There is no CISA KEV entry and no public exploit code identified at time of analysis. The 'Authentication Bypass' tag aligns with the access-restriction bypass described, but the practical impact ceiling - limited to low integrity effects on an unscoped system - constrains the blast radius significantly. This is not a low-real-risk issue masquerading as high-CVSS; the moderate CVSS score accurately reflects a meaningful but bounded vulnerability that is not an immediate priority for most organizations, provided patching is addressed in the normal patch cycle.

An attacker crafts a malicious file and delivers it to a target via email, download link, or other remote channel. When the victim opens the file in a vulnerable version of Chrome, the Passwords subsystem incorrectly resolves an internal reference, allowing the attacker to bypass system access restrictions and write or modify data they should not be permitted to access. No public exploit code has been identified at time of analysis.