Google Chrome EUVD-2026-65966

Exploitation requires two sequential conditions: first, the attacker must have independently compromised the Chrome renderer process through a separate vulnerability - this is the primary constraint captured by AC:H in the CVSS vector. Second, the victim must actively visit an attacker-controlled or compromised web page (UI:R), meaning passive exploitation without user interaction is not possible. The Chromecast component must be present, which is the default in standard Chrome desktop installations. No authentication is required from the attacker's perspective (PR:N), but the prior renderer compromise is itself a non-trivial prerequisite that limits realistic exploitation to sophisticated actors with access to a renderer-level exploit. Exploitation is further limited to Chrome desktop versions prior to 152.0.7977.65.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H correctly captures the dual-stage nature of this attack: a prior renderer process compromise is required (driving AC:H), and the victim must visit a crafted page (UI:R). Despite full C/I/A impact post-exploitation and a scope change, the attack complexity and prerequisite renderer compromise make this a chained exploit scenario - real-world exploitation is significantly harder than a standalone vulnerability. The EPSS score of 0.25% (16th percentile) reinforces this, suggesting threat actors are not currently weaponizing it at scale. No CISA KEV listing is present, and no POC code is referenced in available data. Chromium's 'Critical' severity label reflects maximum potential impact; actual operational risk is moderated by the AC:H prerequisite. This should be patched promptly but does not typically warrant emergency out-of-band response absent KEV confirmation.

An attacker first exploits a separate Chrome renderer vulnerability (e.g., a V8 type confusion or Blink memory corruption flaw) to achieve code execution within the sandboxed renderer process, then serves a crafted HTML page that triggers the Chromecast improper input validation bug, causing the renderer to break out of Chrome's sandbox and execute attacker-controlled code at the host OS privilege level. No public exploit code has been identified at time of analysis, and the two-stage attack chain substantially raises the bar for exploitation.