Google Chrome EUVD-2026-65934

Active user interaction is required: the victim must navigate to an attacker-controlled or attacker-influenced HTML page (UI:R per CVSS vector). No authentication, elevated privileges, or special system configuration is required on the victim's machine - any Chrome user browsing the web with a version prior to 152.0.7977.65 is a potential target under default browser configuration. ANGLE is active in any Chrome session that renders graphics content, which encompasses the overwhelming majority of web pages. Key limiting factors are: (1) the victim must be induced to visit the crafted page, preventing fully passive exploitation; (2) Chrome's multi-process sandbox architecture imposes an additional barrier that the attacker must traverse to reach 'outside the sandbox' impact, which SSVC characterizes as non-automatable; (3) no known public exploit exists at time of analysis, making opportunistic mass exploitation currently unlikely.

The official CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) captures network reachability and full CIA impact but appears inconsistent with the description: the S:U (scope unchanged) designation conflicts with 'code execution outside the sandbox,' which by CVSS 3.1 convention warrants S:C (Changed), elevating the theoretical score to approximately 9.6 Critical. This discrepancy should be verified with Google's security team. EPSS at 0.38% (31st percentile) is low, aligning with SSVC's 'Exploitation: none' - no active exploitation observed by CISA and no KEV listing. However, SSVC simultaneously rates technical impact as 'total,' acknowledging that successful exploitation yields complete system compromise. The 'Automatable: no' SSVC designation suggests the exploitation path requires specific timing or state conditions, reducing mass-exploitation risk. Despite subdued EPSS, Chrome's ubiquitous deployment footprint and the sandbox-escape potential make this a genuine patching priority for any organization - particularly high-value targets susceptible to spearphishing delivery mechanisms.

An attacker hosts a malicious HTML page containing crafted WebGL or canvas-rendering content engineered to trigger the type confusion condition in Chrome's ANGLE layer. A victim on an unpatched Chrome version visits the page through a phishing email link or a malicious advertisement on a legitimate site, causing the GPU process to misinterpret a graphics object's memory type, corrupting memory state and potentially executing attacker-controlled code outside Chrome's sandbox at the privilege level of the logged-in user. No public exploit code is known at time of analysis, and SSVC's 'Automatable: no' assessment suggests reliable exploitation is non-trivial.