Google Chrome EUVD-2026-65938

Exploitation requires a victim running Google Chrome prior to 152.0.7977.65 to actively visit an attacker-controlled web page (UI:R confirmed by CVSS vector). The high attack complexity (AC:H) indicates the attacker must engineer precise conditions - such as specific timing windows, race conditions, or form interaction sequences - to reliably produce and measure the observable discrepancy; this is not a trivially repeatable one-shot exploit. No authentication is required from the attacker's perspective (PR:N), but the victim must be lured to the crafted page. Exploitation impact is limited strictly to information disclosure (C:H, I:N, A:N) - no code execution or integrity violation is enabled. The vulnerability does not affect Chrome 152.0.7977.65 or later on any platform.

The NVD-assigned CVSS 5.3 (Medium) is consistent with a remotely triggerable information-disclosure-only flaw constrained by high attack complexity and mandatory user interaction - two factors that substantially reduce real-world exploitation probability. The C:H rating is notable given the medium overall score, reflecting that successful exploitation can yield high-value sensitive data despite the operational difficulty. EPSS at 0.22% places this in the 13th percentile, aligning with the AC:H barrier deterring mass exploitation tooling. No CISA KEV listing confirms the absence of confirmed active exploitation. No POC is referenced in available intelligence. This is a genuine patch priority for browser-fleet managers - particularly in environments handling sensitive form data - but does not warrant emergency out-of-band response given the complexity and interaction prerequisites.

An attacker hosts a crafted HTML page containing forms engineered to trigger measurable behavioral discrepancies in Chrome's rendering or processing pipeline. When a victim on a vulnerable Chrome version navigates to the page, attacker-controlled JavaScript precisely measures response timing or rendering differences to infer sensitive information - such as cross-origin form state or browser history signals. The AC:H rating reflects that reliable triggering requires careful environmental tuning, making this a targeted attack rather than an opportunistic mass-exploitation vector.