Google Chrome EUVD-2026-65950

Exploitation requires the victim to actively visit an attacker-controlled or compromised HTML page using an unpatched version of Chrome (prior to 152.0.7977.65); user interaction is mandatory and confirmed by UI:R in the CVSS vector. The attacker requires no authentication or privileges (PR:N), but must successfully deliver the crafted page to the victim's browser - typically via phishing, malvertising, or a compromised third-party site. Exploitation is limited to confidentiality impact only; integrity and availability are not affected. Any URL filtering, corporate proxy, or Safe Browsing mechanism that blocks the malicious page prevents exploitation entirely. There is no indication of a required non-default configuration - the Editing component is active in standard Chrome.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N yields a Medium score of 6.5. The high confidentiality impact and no-privilege-required attacker stance are partially offset by the mandatory user interaction (UI:R), which constrains opportunistic mass exploitation. EPSS at 0.36% (28th percentile) independently confirms low exploitation probability in the wild, consistent with the social-engineering step required. No KEV listing and no confirmed POC further reduce urgency for most organizations. Risk is elevated for high-value targets - journalists, government personnel, executives - where spear-phishing or malvertising campaigns could plausibly deliver the crafted page. For general enterprise environments patching within a normal monthly cycle, real-world risk is modest. No conflicting signals between CVSS and description were identified.

An attacker registers a malicious domain or compromises a legitimate site and serves a crafted HTML page that triggers the incorrect authorization flaw in Chrome's Editing component. A targeted victim is lured to the page via a phishing email or malicious advertisement, and upon visiting, the page reads sensitive information - potentially cross-origin data accessible through the editing context - and silently exfiltrates it to an attacker-controlled server. No public exploit code is currently known, making this scenario more plausible for targeted attacks than broad opportunistic campaigns.