Google Chrome EUVD-2026-65932

Exploitation requires an unpatched Chrome user to actively interact with a crafted file - the CVSS UI:R metric confirms user action is mandatory, meaning passive drive-by exploitation without user involvement is not possible. The attacker requires no authentication or existing account on the victim system (PR:N). The flaw is specific to the Safebrowsing component's file-processing pipeline, meaning the crafted file must pass through that validation path, which occurs during download or file evaluation within Chrome. Impact is strictly bounded to a low-integrity bypass - no confidentiality or availability impact is indicated by the CVSS vector. Exploitation is limited to Chrome desktop versions prior to 152.0.7977.65; updated installations are not affected.

The CVSS 4.3 base score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N reflects a moderate, limited-impact finding: scope is unchanged, there is no confidentiality or availability impact, and integrity impact is rated Low. The intelligence tag 'Authentication Bypass' characterizes the flaw as a Safebrowsing restriction bypass, which aligns with the I:L rating. EPSS at 0.22% (12th percentile) is notably low, indicating the broader threat community does not currently assess this as highly likely to be exploited. The absence of a KEV listing corroborates no confirmed active exploitation. The mandatory user interaction (UI:R) prevents automated, wormable exploitation. Taken together, this is a genuine but routine patch-cycle priority - not an emergency - suitable for deployment via Chrome's standard auto-update mechanism rather than out-of-band response.

An attacker crafts a malicious file specifically designed to evade Safebrowsing's input validation and hosts it on an attacker-controlled site or delivers it via a phishing link. When a Chrome user on an unpatched version downloads or interacts with the file, the Safebrowsing component fails to correctly validate it, bypassing the access restriction checks that would normally block or flag the content. No public exploit code has been identified at time of analysis, and the required user interaction limits the feasibility of large-scale automated campaigns.