Google Chrome EUVD-2026-65985

Exploitation has two hard prerequisites: first, the attacker must have already achieved arbitrary code execution within Chrome's renderer process via a separate, independent vulnerability - this is not a configuration option but a required prior exploitation step. Second, user interaction is required (UI:R): the victim must visit an attacker-controlled HTML page that delivers the renderer exploit and the origin-bypass payload. Without a pre-compromised renderer, this vulnerability is not independently exploitable. No non-default configuration setting is required - a standard Chrome installation below 152.0.7977.65 on any desktop platform is in scope. Impact is limited to confidentiality (C:L) - there is no mechanism for integrity modification or availability disruption through this flaw alone.

The official CVSS 3.1 score of 4.3 Medium (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) materially understates the prerequisite attack complexity: the AC:L metric does not capture the hard requirement that the renderer process must already be independently compromised. In practice this transforms the vulnerability into a chained, second-stage flaw rather than a standalone primitive. EPSS at 0.26% (18th percentile) confirms negligible observed exploitation interest. No CISA KEV listing and no POC code exist at time of analysis. The impact ceiling is C:L with no integrity or availability consequence. The realistic threat is narrow - primarily relevant to sophisticated adversaries constructing multi-stage browser exploitation chains - and substantially lower than the moderate CVSS number implies.

An attacker who has independently achieved code execution within a victim's Chrome renderer process - through a separate vulnerability such as a heap corruption or type confusion flaw - serves the victim a crafted HTML page that leverages the missing Network authorization check to issue cross-origin requests. The Network component fails to block these requests, allowing the attacker to read responses from origins where the victim holds an authenticated session, such as internal web applications. No public exploit or POC exists at time of analysis.