Google Chrome EUVD-2026-65954

User interaction is required: the victim must actively visit a crafted HTML page, per CVSS UI:R. No authentication to any service is required on the attacker's side (PR:N). No special browser configuration or feature flag needs to be enabled - standard Chrome with default settings processing CSS is sufficient. Exploitation is limited to the confidentiality dimension only (I:N, A:N); an attacker cannot modify data or cause a crash. The scope is unchanged (S:U), meaning the attacker cannot break out of the browser sandbox via this flaw alone. The primary limiting factor is the mandatory user-interaction step, which requires a social engineering or malicious-advertisement delivery vector.

The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N places this as a remotely exploitable, low-complexity, unauthenticated flaw with high confidentiality impact but requiring user interaction - a common profile for browser-based information disclosure bugs. The 6.5 base score reflects the UI:R requirement dampening raw severity. EPSS at 0.17% (7th percentile) is markedly low, indicating the security community does not broadly anticipate near-term exploitation in the wild, consistent with the absence of a CISA KEV entry and no confirmed public POC. The high CVSS C:H metric deserves scrutiny: CSS information leaks often expose limited data (e.g., visited link status, cross-origin style inference) rather than full credential or session-token disclosure; the actual data class leaked is not specified in available intelligence. Priority should be moderate - patch Chrome as part of normal update cadence rather than emergency response, unless the organization operates environments where unpatched browsers persist for extended periods.

An attacker hosts a malicious website containing specially crafted CSS that triggers the information disclosure when rendered by Chrome. The attacker distributes a link via phishing email or malicious advertisement; when the victim clicks and the page loads, Chrome's CSS engine leaks sensitive information - potentially cross-origin data or browser state - back to the attacker-controlled page. No public POC has been identified, making opportunistic mass exploitation unlikely at this time.