Google Chrome EUVD-2026-65914

Exploitation requires the victim to visit a crafted HTML page using an unpatched Chrome browser on Windows (confirmed by description: 'Google Chrome on Windows prior to 152.0.7977.65'). Hardware-accelerated graphics must be enabled - Chrome's default configuration on Windows - so that ANGLE processes rendering calls via DirectX. The victim must have at least one other origin's content loaded or recently rendered in the same browser session for residual GPU memory to contain cross-origin data worth leaking. The attacker has no authentication requirement (PR:N) but cannot exploit without the victim performing the act of visiting the page (UI:R). Exploitation is limited to Windows only; non-Windows Chrome users are not affected by this specific flaw. Non-default configurations that disable GPU acceleration or WebGL would prevent exploitation.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) signals high confidentiality impact with low exploitation complexity, but requires user interaction - the victim must visit an attacker-controlled page. EPSS at 0.29% (21st percentile) and absence from CISA KEV consistently indicate no observed widespread exploitation at time of analysis. These signals together suggest this is not an opportunistic, mass-exploitation target but could be leveraged in targeted attacks against high-value individuals browsing on Windows. The C:H rating is appropriate: cross-origin data leakage via the GPU layer can expose sensitive page content from other origins open in the same browser session. The platform restriction to Windows further narrows the exposed population. No data conflict is evident between CVSS vector and description - both confirm network delivery with required user interaction.

An attacker hosts a crafted HTML page containing WebGL or CSS/SVG graphics operations designed to trigger ANGLE's uninitialized render buffer, causing the browser to expose GPU memory populated with pixel or data content from a previously rendered cross-origin context. A victim on Windows running an unpatched Chrome visits the attacker's page - either through phishing, a malicious advertisement, or a compromised legitimate site - after which the attacker's JavaScript reads the leaked data and exfiltrates it to an attacker-controlled server. No public proof-of-concept has been identified, raising the practical exploitation bar.