Google Chrome EUVD-2026-65935

Exploitation requires that the targeted user actively visits an attacker-controlled HTML page using Google Chrome prior to version 152.0.7977.65. The CVSS PR:N metric confirms no attacker authentication or account is needed, but UI:R is mandatory - the victim must open the malicious page; passive network exposure is insufficient. The impact is bounded to a low integrity violation (I:L) with no confidentiality or availability consequence, and S:U indicates no scope change beyond the browser's own security context. Non-default configurations are not required; any user browsing the web with a vulnerable Chrome version is potentially exposed.

The CVSS 3.1 score of 4.3 (Medium) reflects a network-accessible, low-complexity flaw requiring no attacker privileges but mandating user interaction (UI:R), with impact limited to low integrity (I:L) and no confidentiality or availability consequences. Google's own Chromium severity rating of Medium is consistent with this score. The EPSS score of 0.38% at the 31st percentile provides a low exploitation-probability signal, suggesting this vulnerability has not attracted significant attacker attention relative to the broader vulnerability population. KEV status is not confirmed and no public exploit code has been identified, making this a patch-on-schedule rather than emergency-response issue for most organizations. The UI:R requirement meaningfully constrains automated or mass exploitation, as passive network exposure alone is insufficient - a user must actively visit the attacker's page.

An attacker registers or compromises a web domain and hosts a crafted HTML page designed to trigger Chrome's Network authorization flaw. The attacker delivers the link via phishing email or malvertising. When a user on a vulnerable Chrome version visits the page, the browser's authorization logic incorrectly permits a network-level action that should be blocked, enabling the attacker to achieve a limited unauthorized write or state modification within the browser's network context.