Google Chrome EUVD-2026-65969

Exploitation requires the victim to load attacker-controlled web content in a vulnerable macOS Chrome build (UI:R - user interaction in the form of visiting or rendering a crafted HTML page). No authentication or prior privileges are needed (PR:N), and no special browser configuration is required - default Chrome is affected. Limiting factors: the target must be running Chrome for macOS older than 152.0.7977.65; the attack is not automatable per SSVC; and reliably converting a browser-process use-after-free into out-of-sandbox code execution is technically demanding, which constrains real-world exploitation despite the network attack vector.

The signals here are genuinely mixed and should be weighed rather than taken at face value. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) plus a full/'total' SSVC technical impact and a sandbox escape make the theoretical severity very high - successful exploitation gives complete control of the browser process. However, the exploitation-focused signals are all cool: SSVC exploitation status is 'none' and automatable 'no', EPSS is only 0.41% (34th percentile), the CVE is not on CISA KEV, and no public exploit has been identified. The one true limiting factor is UI:R - the victim must open a malicious page - and use-after-free bugs in the browser process are non-trivial to weaponize reliably, which is consistent with the low EPSS. Net assessment: this is a legitimate high-priority patch because it is a critical-rated browser sandbox escape affecting a ubiquitous product, but it is not a demonstrated in-the-wild threat today; organizations should prioritize it as routine-but-prompt browser patching rather than an emergency zero-day response. Any operator running managed macOS Chrome fleets should push the update promptly given how trivially browsers encounter untrusted web content.

An attacker hosts a crafted HTML page (or injects it via a malvertisement or compromised site) and lures a macOS Chrome user to visit it. When the page is rendered, it triggers the use-after-free in the Views component, corrupting browser-process memory to execute attacker-controlled code outside the renderer sandbox. No public proof-of-concept has been identified, and the AV:N/AC:L/UI:R vector means the only precondition beyond network reachability is that the victim opens the page.