Google Chrome EUVD-2026-65979

The victim must be running Google Chrome on Windows-the vulnerability is explicitly platform-specific and does not affect Chrome on Linux or macOS-in any version prior to 152.0.7977.65. The victim must navigate to an attacker-controlled HTML page, satisfying the UI:R requirement from the CVSS vector; no further interaction beyond page load is implied. No authentication or special privileges are required from either the attacker or the victim (PR:N per CVSS). The ANGLE graphics subsystem must be active, which is the default state for Chrome's hardware-accelerated rendering pipeline. Limiting factors include: Windows-only platform scope, mandatory victim interaction requiring successful phishing or malvertising delivery, and the technical challenge of converting an out-of-bounds read into a reliable sandbox escape, which increases attacker complexity beyond what the CVSS AC:L rating alone implies at the exploitation chain level.

The CVSS 8.8 score reflects high network-exploitable severity with low attack complexity and no privilege requirements, but the EPSS score of 0.35% at the 28th percentile is notably low for a high-CVSS vulnerability, and SSVC classifies exploitation as 'none' with automatable set to 'no'-these signals together indicate no observed mass exploitation or publicly weaponized exploit at time of analysis. These signals are internally consistent and do not conflict. The SSVC technical impact rating of 'total' and the sandbox escape nature of the vulnerability are the strongest real-world risk drivers: successful exploitation bypasses Chrome's primary containment layer, achieving arbitrary code execution outside the renderer sandbox. The non-automatable SSVC classification aligns with UI:R in CVSS-broad exploitation is constrained by the need to direct victims to attacker-controlled content. The overall picture is a high-potential, low-current-exploitation flaw where rapid patch deployment is the clearly appropriate response for any organization running Chrome on Windows endpoints.

An attacker hosts a crafted HTML page containing specially constructed graphics or WebGL content designed to trigger the out-of-bounds read in Chrome's ANGLE engine during rendering. A Windows user browsing to this page in an unpatched Chrome version triggers the memory corruption, which the attacker chains into code execution outside the Chrome renderer sandbox. No public exploit code has been identified at time of analysis, but the sandbox escape primitive makes this a high-value target for exploit development.