Google Chrome EUVD-2026-65986

Exploitation requires that the victim use Google Chrome prior to version 152.0.7977.65 on desktop and visit a crafted HTML page under attacker control - this is the sole prerequisite. The CVSS vector PR:N confirms no authentication is required of the attacker, and AC:L indicates no special race condition or complex configuration is needed. UI:R is the primary limiting factor: the victim must actively navigate to the malicious page. No specific Chrome feature flag, non-default setting, or particular OS configuration is required. Exploitation is limited to confidentiality (camera/microphone data); no integrity or availability impact applies.

The CVSS 6.5 score reflects a Medium-severity network-reachable vulnerability with High confidentiality impact, but the UI:R requirement means exploitation is contingent on victim interaction - the user must navigate to a malicious page. The EPSS score of 0.17% at the 6th percentile strongly suggests this has not been operationalized into active exploitation campaigns; this is consistent with the absence of a CISA KEV listing. The combination of no KEV, no POC, and a below-average EPSS percentile positions this as a patch-cycle priority rather than an emergency response item. That said, the nature of the impact - silent access to camera and microphone - carries meaningful privacy consequences, and the low attack complexity (AC:L) and lack of privilege requirements on the attacker side mean that if POC code emerges, exploitation would be straightforward for anyone who can deliver a link to a target.

An attacker hosts a crafted HTML page that invokes the GetUserMedia API in a way that exploits the incorrect authorization logic, bypassing the browser's normal permission gate. When a Chrome user visits the page - via a phishing link, malicious ad, or compromised site - the page silently gains access to the camera or microphone feed without the expected user consent prompt or with a prompt that misrepresents the scope of access. No public exploit code has been identified at time of analysis.