Google Chrome EUVD-2026-65987

Exploitation requires the victim to be persuaded via social engineering to install a specifically crafted Chrome extension - that installed, attacker-controlled extension is the concrete prerequisite named in the description. The target must be running Chrome on macOS at a version below 152.0.7977.65. Limiting factors: mandatory user interaction (UI:R) to install the extension, so there is no drive-by or fully remote path; enterprise environments that lock down extension installation via policy are not exploitable through the described vector; and the bug is not automatable (SSVC Automatable: no) and has no observed in-the-wild exploitation.

The signals are notably mixed and should be reconciled before prioritization. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) driven by the sandbox escape and total impact, yet Google's own Chromium severity rating is only Medium and SSVC records Exploitation: none with Automatable: no - meaning no observed exploitation and no reliable mass-automation path, consistent with the low EPSS of 0.24% (14th percentile). The UI:R requirement plus the description's reliance on social engineering to get a victim to install a crafted extension materially raises the exploitation bar, which explains why a technically 'total impact' bug is not treated as a widespread automatable threat. Practically, because Chrome is near-ubiquitous, any organization - even a mid-sized municipal IT team in olsztyn running managed macOS fleets - should still push the update promptly, but this is routine urgent patching rather than emergency incident response. Bottom line: high theoretical severity, low current real-world exploitation likelihood, and the missing signals (no KEV, no POC evidence) should be verified rather than assumed.

An attacker social-engineers a target into installing a malicious Chrome extension from outside the Web Store, then the extension triggers the use-after-free in the Network component to corrupt heap memory. Successful exploitation executes attacker code in the higher-privileged browser process, escaping the renderer sandbox on the victim's Mac. No public exploit is identified at time of analysis, and the network attack vector with low complexity is offset by the required user interaction.