Google Chrome EUVD-2026-65983

Exploitation requires the victim to actively visit or be redirected to an attacker-controlled crafted HTML page (CVSS UI:R - user interaction is mandatory and non-negotiable). The attack additionally appears to require that a privileged Chrome internal page be accessible within the same browser session at the time of exploitation, based on the description referencing 'a privileged page' as the target. The victim's Chrome version must be prior to 152.0.7977.65. No server-side misconfiguration or authenticated access is required of the attacker. Exploitation is limited by: mandatory user interaction (UI:R), the need for a privileged page to be in scope within the same session, Scope:Unchanged containing impact to the victim's own browser context, and limited confidentiality impact (C:L - no integrity or availability impact). These factors meaningfully reduce realistic risk beyond what the network-reachable attack vector alone implies.

The CVSS 4.3 (Medium) score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a network-reachable, low-complexity flaw with no required privileges, but mandatory user interaction and limited, contained confidentiality impact. The EPSS score of 0.18% at the 8th percentile is very low, indicating that this vulnerability sits well below the threshold of commonly exploited issues. There is no CISA KEV listing and no identified public proof-of-concept, further reducing urgency. The Scope:Unchanged rating is notable: despite the same-origin policy bypass, the impact does not escape the victim's browser session, which substantially limits the blast radius compared to scope-changed browser bugs. While conceptually significant - bypassing origin isolation into privileged pages is a sensitive primitive - the combination of low EPSS, no KEV listing, limited confidentiality impact (C:L), and required user interaction places this firmly in the patch-on-next-cycle category for most organizations rather than an emergency response.

An attacker crafts a malicious HTML page that abuses a flaw in Chrome's StreamsAPI implementation to read resources from a privileged browser page (such as a chrome:// internal page) loaded in the same browser session. The victim is socially engineered - via phishing, malvertising, or a compromised site - into visiting the crafted page, triggering the cross-origin policy bypass and leaking limited data back to the attacker. No public proof-of-concept has been identified, so independent rediscovery of the specific technique would be required.