Google Chrome EUVD-2026-65939

Exploitation requires a victim to actively visit a crafted HTML page using a vulnerable version of Google Chrome (any release prior to 152.0.7977.65). The CVSS vector UI:R confirms mandatory user interaction - passive network exposure alone is insufficient. The attack targets the Workers API, meaning the crafted page must instantiate concurrent Web Workers to trigger the race condition timing window. No attacker authentication or privileges are required (PR:N). Limiting factors include: the social engineering dependency (user must browse to attacker content), Chrome's multi-process sandbox architecture which constrains the practical scope of any access restriction bypass, and the inherent timing sensitivity of race condition exploitation which reduces reliability. The flaw is not exploitable against default browser configurations absent user interaction with attacker-controlled content.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects meaningful integrity impact but is tempered by two important factors: required user interaction (UI:R) and no confidentiality or availability impact. The EPSS score of 0.19% at the 9th percentile is strikingly low - well below the threshold that typically signals active exploitation - and there is no CISA KEV listing. No public exploit code has been identified, making opportunistic mass exploitation unlikely. Defenders should treat this as a standard patch-cycle priority: the vendor has released a fix, and Chrome's auto-update mechanism will resolve exposure for most consumer endpoints with minimal intervention. Enterprise environments with managed Chrome deployments should validate that version 152.0.7977.65 has propagated. The AC:L rating in the vendor CVSS is notable given the inherent timing complexity of race condition exploitation; real-world reliability may be lower than the score implies.

An attacker crafts an HTML page containing JavaScript that spawns multiple concurrent Web Workers designed to hit the race condition window in Chrome's shared-resource access logic. The attacker delivers the page via phishing link or a compromised/malicious website; a victim running an unpatched Chrome version visits the page, triggering the race, which bypasses system access restrictions and achieves unauthorized integrity impact within the browser context. No public proof-of-concept has been identified at time of analysis.