Google Chrome EUVD-2026-65923

The victim must actively visit a crafted HTML page using Google Chrome on an Android device running a version prior to 152.0.7977.65 - the vulnerability is Android-platform-specific and does not affect Chrome on Windows, macOS, or Linux. User interaction is required (CVSS UI:R): the victim must load the attacker-controlled page. No authentication or privileges are required from the attacker's perspective (PR:N). The sandbox boundary (S:U) limits exploitation: even a successful OOB read is contained within the GPU process and cannot directly pivot to the browser process or OS kernel without a separate sandbox escape primitive. No special Chrome configuration, feature flag, or non-default setting is required beyond the victim using Chrome on Android.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5 Medium, reflecting network-reachable exploitation requiring only that a victim visit a crafted page - no authentication or special complexity needed. However, S:U (scope unchanged) indicates Chrome's sandbox architecture prevents the OOB read from crossing process boundaries into the browser process or OS, meaningfully capping real-world impact. EPSS at 0.24% (15th percentile) strongly corroborates low exploitation pressure; this is well below the threshold commonly used for prioritized patching. No CISA KEV listing and no public POC are confirmed at time of analysis. The net picture: real vulnerability with confirmed patch, but low exploitation urgency relative to other active threats. Android-only scope further reduces the affected surface relative to the full Chrome install base. The primary risk is targeted memory disclosure to a sophisticated actor willing to craft a bespoke exploit, not broad opportunistic scanning.

An attacker hosts a web page containing a specially crafted HTML and GPU draw sequence designed to trigger the out-of-bounds read in Chrome's GPU process on Android. A victim using Chrome on Android who visits this page - via a phishing link, malicious advertisement, or compromised site - causes the GPU process to read memory beyond an intended buffer boundary, potentially leaking process memory contents back to the attacker. No public POC exists at time of analysis, so exploitation would currently require independent vulnerability research and exploit development.