Google Chrome EUVD-2026-65984

Exploitation requires that the victim be running Google Chrome prior to version 152.0.7977.65 on any supported desktop platform, and must actively visit a crafted HTML page controlled by the attacker - passive network exposure alone is not sufficient (CVSS UI:R). No authentication to Chrome or any service is needed from the attacker's side (PR:N). The impact is limited to partial confidentiality loss (C:L); there is no integrity or availability impact. Exploitation is further limited by the uninitialized-resource class of bug: the attacker cannot guarantee the content of the uninitialized memory, making reliable cross-origin data extraction probabilistic rather than deterministic. No special non-default browser configuration is required - any default Chrome installation below the fix version is in scope.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) but mandating user interaction (UI:R), with unchanged scope (S:U) and only partial confidentiality impact (C:L, I:N, A:N). This vector is internally consistent: the attack surface is large (any Chrome user who visits a crafted page) but the attacker cannot independently trigger exploitation without victim action. EPSS at 0.24% in the 15th percentile strongly suggests this vulnerability has not attracted widespread automated exploitation tooling. There is no CISA KEV entry and no publicly documented POC. The 'Authentication Bypass' tag in the source data refers to bypass of the browser's web origin policy (SOP), not to application-layer authentication - this distinction matters for triage. Overall, this is a low-urgency but broadly applicable patch: the product's ubiquitous install base makes total exposure count high even at low per-instance severity, justifying timely application of the vendor patch within a normal patch cycle rather than emergency response.

An attacker hosts a malicious web page containing crafted HTML and graphics workload designed to trigger an uninitialized resource read within Chrome's ANGLE layer. When a victim using Chrome prior to 152.0.7977.65 navigates to this page, the browser processes the graphics content, and ANGLE reads uninitialized memory that may contain residual data from a different web origin, potentially disclosing cross-origin content to the attacker's script. No public POC has been identified at time of analysis, and the attack is opportunistic rather than targeted given the passive user-interaction requirement.