Google Chrome EUVD-2026-65917

Exploitation requires a user to navigate to or open a page serving a specially crafted media file; the CVSS UI:R metric confirms that user interaction is mandatory and an attacker cannot exploit this passively. The CVSS PR:N vector confirms no attacker authentication is required. Chrome's sandbox (S:U) restricts the impact of a successful read to the renderer process - a chained sandbox escape would be required to achieve OS-level compromise, which is a significant additional barrier not evidenced in available data. No non-default Chrome configuration or feature flag must be enabled; any Chrome installation prior to 152.0.7977.65 that processes external media content is within scope. Exploitation is limited by: mandatory user interaction to trigger media parsing, Chrome's renderer sandbox containing in-process memory disclosure, absence of a known public proof-of-concept, and the low EPSS score suggesting practical exploitation difficulty.

The CVSS 8.1 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) reflects a remotely exploitable flaw requiring no attacker authentication, though user interaction is a meaningful mitigation factor - the victim must open or browse to a page serving the crafted media. The C:H and A:H ratings indicate the potential for significant in-process memory disclosure and renderer crashes, but the S:U scope confirms Chrome's sandbox contains the impact and prevents direct OS-level compromise without a chained sandbox escape. Critically, the EPSS exploitation probability of 0.25% (16th percentile) is strikingly low relative to the CVSS severity - a common pattern for sandboxed browser vulnerabilities where theoretical impact outpaces practical exploitation likelihood, particularly absent a public proof-of-concept. No CISA KEV listing confirms the absence of observed active exploitation at time of analysis, though this is an absence-of-evidence signal rather than positive confirmation. There is no discrepancy in the CVSS vector itself - AV:N with UI:R is consistent with drive-by media delivery - but the gap between CVSS 8.1 and EPSS 16th percentile suggests this should be treated as a high-priority routine patch rather than an active incident.

An attacker crafts a malicious media file designed to trigger the Skia out-of-bounds read and hosts it on a controlled webpage, then delivers the link to a target via phishing or malvertising. When the victim opens the page with a vulnerable Chrome browser, the Skia media parser processes the file and reads beyond the allocated buffer boundary, potentially leaking heap memory contents from the renderer process to the attacker. No public proof-of-concept exists at time of analysis, but the AV:N/UI:R attack profile - requiring only that the user visit a page - makes drive-by delivery straightforward once a reliable exploit is developed.