Google Chrome EUVD-2026-65972

Exploitation requires that a victim user actively navigate to a crafted HTML page controlled by the attacker - this is the UI:R condition that prevents fully automated exploitation. The attacker requires no authentication or privileges against the target system (PR:N), and Chrome's default configuration is sufficient for the vulnerability to be triggered; no special browser settings, extensions, or server-side configurations are required. Exploitation is limited to confidentiality impact (I:N, A:N), meaning an attacker cannot modify data or cause a denial of service via this vector alone. The unchanged scope (S:U) means the vulnerability does not directly enable cross-origin privilege escalation or sandbox escape. Exploitation is further limited to versions of Chrome strictly prior to 152.0.7977.65; endpoints where Chrome's automatic update mechanism has already applied the patch are not exposed.

The CVSS 6.5 Medium score reflects the combination of network reachability and high confidentiality impact offset by mandatory user interaction (UI:R), which prevents fully automated, drive-by exploitation without some social engineering step. The EPSS score of 0.20% at the 10th percentile is notably low, indicating that across the broader vulnerability population, this CVE ranks in the bottom decile for observed exploitation likelihood - suggesting it has not attracted significant attacker tooling at time of analysis. The absence of a CISA KEV entry and no known public proof-of-concept further depresses real-world urgency. Despite Google Chrome's ubiquitous deployment footprint, the limiting UI:R factor means exploitation is not automatable at scale without a delivery mechanism (phishing, malvertising, or watering-hole attack). The scope is unchanged (S:U), so cross-origin escalation is not directly implied. Net assessment: this is a genuine confidentiality risk warranting prompt patching in enterprise managed fleets - particularly where Chrome accesses sensitive internal applications - but the low EPSS and no-KEV status do not support emergency out-of-band response. Automated update mechanisms in Chrome (which update silently on most consumer and managed endpoints) significantly reduce the exposed population over time.

An attacker crafts an HTML page embedding CSS injection payloads - for example, attribute selector rules with url() callbacks to an attacker-controlled server - targeting sensitive data values present in the DOM of the page being rendered. The victim is lured to visit the malicious page through a phishing link or malvertising, and the Chrome CSS engine evaluates the injected selectors, triggering network requests that encode and exfiltrate the targeted data to the attacker. No public proof-of-concept exploit code has been identified at time of analysis, but CSS-based data exfiltration is a well-documented technique in the security research community.