Google Chrome EUVD-2026-65944

Exploitation requires that a victim user actively visit or load a crafted HTML page using an unpatched version of Google Chrome (prior to 152.0.7977.65). The CVSS vector PR:N confirms no attacker-held credentials or privileges are required. The CVSS UI:R metric confirms that user interaction - specifically loading the malicious page - is a hard prerequisite; this is the primary limiting factor against automated or opportunistic mass exploitation. The flaw is confined to the Network component; no non-default configuration, specific feature enablement, or special platform variant is indicated as required beyond running a vulnerable Chrome version. Exploitation does not result in confidentiality or availability impact (C:N/A:N), limiting the blast radius to integrity bypass.

The CVSS 3.1 base score of 6.5 (Medium) is driven primarily by the high integrity impact (I:H) combined with network attack vector (AV:N) and low complexity (AC:L), offset by the mandatory user interaction (UI:R) and absence of confidentiality or availability impact. Real-world risk is moderate rather than critical: the UI:R requirement substantially raises the bar compared to fully client-less exploitation, as attackers must successfully deliver and have a victim load a crafted page. EPSS at 0.23% (13th percentile) independently corroborates low current exploitation activity. There is no CISA KEV listing and no publicly disclosed proof-of-concept code at time of analysis. The primary risk amplifier is prevalence - Chrome's near-universal deployment footprint means even a low exploitation rate across its user base translates to a significant absolute attack surface. No conflicting signals between CVSS and description are observed; both consistently describe a remotely triggered, user-interaction-dependent integrity bypass.

An attacker hosts a crafted HTML page designed to trigger the missing authorization check in Chrome's Network component, then delivers a link to the page via phishing email, social media, or malvertising. When the victim opens the link in an unpatched Chrome browser, the page silently bypasses the system access restriction, allowing the attacker to achieve unauthorized write or modification actions (high integrity impact) within the scope of the browser session. No public proof-of-concept code has been identified at time of analysis.