Google Chrome EUVD-2026-65931

The attacker must induce the victim to visit a crafted HTML page (UI:R per CVSS); no authentication or prior account access is required on the target system. The victim must be running an unpatched version of Google Chrome prior to 152.0.7977.65. The vulnerability appears to be reachable via standard web content rendering (likely WebGL or canvas-based graphics), which is enabled by default in Chrome - no non-default configuration is required. Exploitation is limited by the requirement for user interaction (page visit), the complexity of crafting a reliable memory corruption exploit in a hardened browser environment, and Chrome's built-in sandbox, which the attacker must also escape as a second stage. The Chromium 'Medium' internal severity rating may reflect this multi-stage requirement despite the AC:L CVSS assignment.

The CVSS 8.8 (High) vector - AV:N/AC:L/PR:N/UI:R/S:U - indicates network-reachable, low-complexity, unauthenticated exploitation requiring only user interaction (visiting a page). However, the description states code executes 'outside the sandbox,' which implies a scope change not reflected in the assigned S:U metric; this warrants independent scrutiny and potentially elevates real-world impact to Critical tier. Contrasting this, Chromium's own severity rating is 'Medium,' suggesting the Chrome security team has additional context (e.g., reliability constraints or exploitation difficulty) that tempers the theoretical severity. EPSS at 0.30% (22nd percentile) and SSVC exploitation status 'none' both indicate no observed in-the-wild activity. SSVC technical impact is rated 'total,' consistent with the full C:H/I:H/A:H CVSS impact scores. Overall: this is a genuine high-severity browser code execution vulnerability with patch available, but current intelligence signals suggest active exploitation is absent. The discrepancy between 'outside the sandbox' (scope change) and S:U in the assigned vector should be clarified with vendor advisory.

An attacker serves a crafted HTML page containing malicious WebGL or canvas operations designed to trigger the out-of-bounds write in ANGLE during graphics processing. When a Chrome user visits the page, the corrupted memory state is leveraged to achieve code execution within the renderer process and subsequently escape the Chrome sandbox, resulting in arbitrary code execution at the operating system level. No public proof-of-concept code has been identified at time of analysis, but the completeness of the CWE-787 primitive in a widely-studied codebase makes weaponization a realistic near-term risk.