Google Chrome EUVD-2026-65949

Exploitation unconditionally requires the victim to visit an attacker-controlled or compromised web page - the CVSS vector (UI:R) confirms this mandatory user interaction. The attacker requires no authentication or privileges (PR:N), and the attack complexity is low (AC:L), meaning no race conditions or special environment states must be satisfied beyond the page visit. Impact is limited strictly to confidentiality (C:H, I:N, A:N) with no scope change (S:U), so the leak cannot pivot to integrity or availability compromise within this vulnerability alone. The flaw affects all desktop Chrome versions prior to 152.0.7977.65 with no documented dependency on non-default configurations. The primary limiting factor for defenders is the mandatory UI:R interaction, which social engineering or malvertising can satisfy.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) presents an accessible attack surface: network-reachable, low complexity, no attacker privileges required, and only a single user interaction (page visit) separating a remote attacker from high-confidentiality impact. However, three signals substantially lower real-world urgency: EPSS is 0.22% at the 13th percentile, no CISA KEV listing exists, and no public POC has been identified. The unchanged scope (S:U) means the leak is bounded within the browser's security context and does not affect other system components. Chromium's own Medium severity rating aligns with these signals. This is a legitimate risk warranting timely patching but not emergency response prioritization - the high CVSS confidentiality score reflects potential impact if exploited, not probability of exploitation.

An attacker crafts a malicious HTML page that triggers the Animation component's information leak - for example, by constructing specific CSS keyframe sequences or Web Animations API calls that cause the engine to expose memory contents or cross-origin state. The attacker then delivers the link to a target user via phishing or a compromised website. Upon visiting the page, the victim's browser processes the animation and the leaked data is exfiltrated back to the attacker. No public POC exists at time of analysis, and the attack requires active user navigation to the malicious page.