Google Chrome EUVD-2026-65947

The victim must actively visit or be redirected to an attacker-controlled HTML page in an unpatched Chrome browser (prior to 152.0.7977.65), satisfying the UI:R requirement. The AC:H rating indicates that reliable exploitation further requires specific conditions - likely precise timing windows, particular browser caching state, or the victim being simultaneously authenticated to a target origin whose state is being probed. The Chromium issue 517697155 is not publicly disclosed, so the exact triggering HTML construct is unknown at time of analysis. Exploitation is limited to confidentiality - no code execution, no integrity or availability impact. Attackers cannot exploit this server-side; they require the victim's browser to render the crafted page. Non-default configurations are not required, but the attack complexity barrier means opportunistic mass exploitation is unlikely.

The CVSS 3.1 base score of 5.3 (Medium) is calibrated by AC:H and UI:R, which significantly constrain exploitability in practice: an attacker must craft a page that a victim actively visits, and the side-channel technique must be reliably triggered under real-world browser scheduling and network conditions - both non-trivial requirements. The C:H impact metric is notable, suggesting that when exploitation succeeds, the disclosed information could be highly sensitive (e.g., cross-origin authentication state or cached credential data). However, the EPSS score of 0.22% at the 13th percentile indicates the security community assigns very low probability of widespread exploitation in the near term, consistent with the high complexity bar. No active exploitation has been reported (KEV status absent) and no public proof-of-concept has been identified at time of analysis. The Chromium security severity is rated Medium, aligning with NVD. On balance, this is a real but lower-urgency issue: organizations running Chrome at scale should prioritize the update as part of normal patch cadence rather than emergency response, since mass exploitation is unlikely given AC:H, but targeted attacks against high-value users (e.g., those authenticated to sensitive SaaS platforms) remain plausible.

An attacker hosts a crafted HTML page designed to probe Chrome's rendering or caching behavior across origins - for example, using timing measurements on resource loads or pixel-level rendering differences - to infer whether the visiting user is authenticated to a target site. The victim is lured to the attacker's page via phishing, malvertising, or an embedded iframe, and the page silently leaks cross-origin state back to the attacker. No public proof-of-concept has been identified at time of analysis, but the general class of discrepancy-based side-channel attacks is well-documented in browser security research.