Google Chrome EUVD-2026-65982

Exploitation is platform-scoped to macOS - Chrome on Windows and Linux is not affected by this vulnerability. The target must be running a Chrome version prior to 152.0.7977.65 on macOS with hardware-accelerated graphics enabled (the default state). The attack requires the user to visit an attacker-controlled or compromised web page (UI:R); there is no pathway for exploitation without this user interaction step. No authentication, prior account access, or system foothold is required from the attacker (PR:N per the CVSS vector). Non-default configurations that disable hardware acceleration (chrome://flags or enterprise policy) would remove ANGLE from the rendering path and block this attack vector. Exploitation is limited by the macOS-only platform scope and the mandatory user navigation action.

The CVSS 8.8 rating (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-exploitable flaw requiring only a user to visit a web page, with no privilege or authentication barrier for the attacker. A notable inconsistency exists in the provided vector: the description explicitly states code execution 'outside the sandbox,' which in CVSS 3.1 terminology corresponds to a scope change (S:C), yet the vendor-assigned vector uses S:U - security teams should seek clarification from the Chrome Security team on this scoring decision, as S:C would raise the base score above 9.0. Countering the high CVSS signal, the EPSS score of 0.21% at the 12th percentile is low, indicating that the broader threat intelligence community does not currently observe active exploitation, and there is no CISA KEV listing to contradict that assessment. The combination of no public exploit, low EPSS, and single-platform scope (macOS only) places this in a standard patch-cycle priority rather than an emergency break-fix category, though the near-zero attacker prerequisites mean the exposure window should still be closed promptly once a patch cycle opens.

An attacker crafts an HTML page containing WebGL or canvas-based content specifically designed to trigger the improper input validation flaw in Chrome's ANGLE Metal backend on macOS. The attacker distributes a link to this page via phishing email or malvertising embedded in a legitimate ad network. When an unpatched macOS Chrome user clicks the link, the crafted graphics payload causes ANGLE to process invalid input, enabling the attacker to execute arbitrary code in a process context outside Chrome's renderer sandbox - potentially the browser process or the OS user context. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates an exploit would not require significant development effort once the vulnerability mechanics are understood.