Google Chrome EUVD-2026-65945

Exploitation requires a victim running Google Chrome prior to 152.0.7977.65 to visit a crafted HTML page under attacker control - user interaction (UI:R) is a hard prerequisite and cannot be bypassed. The CVSS vector (PR:N) confirms no authentication is required on the attacker's side. The ServiceWorker API must be available in the browser, which is enabled by default in all affected Chrome versions; no non-default configuration is needed. Exploitation is strictly limited to confidentiality impact (C:H, I:N, A:N) - attackers cannot modify data or disrupt service availability through this vector. The scope is unscopped (S:U), meaning the impact is contained to the vulnerable Chrome instance and does not propagate to other browser contexts or the underlying OS.

The CVSS 3.1 base score of 6.5 is driven by a network-reachable (AV:N), low-complexity (AC:L) attack vector requiring no privileges (PR:N) but mandating user interaction (UI:R), with high confidentiality impact (C:H) and no integrity or availability impact. The EPSS score of 0.27% at the 18th percentile indicates low near-term exploitation probability, and no CISA KEV listing exists. No public exploit code has been identified. The UI:R requirement represents meaningful friction - exploitation cannot occur passively and requires social engineering or a redirect to a malicious page. Chromium's own internal severity rating of Medium aligns with this reading: the impact is real but bounded to information disclosure with no code execution or availability risk. Overall, this is a genuine but non-emergency priority; organizations should apply the Chrome 152.0.7977.65 update within their normal patch cadence rather than invoking an out-of-band response.

An attacker registers a malicious ServiceWorker on a crafted web page and lures a victim to visit it via phishing or a malicious redirect. Upon page load, the ServiceWorker exploits the information leak to read sensitive cross-origin data - such as authentication tokens, cached API responses, or cookies - and exfiltrates them to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, so this remains a theoretical scenario grounded in the CVSS vector.