Google Chrome EUVD-2026-65991

Exploitation requires a single, active user interaction: the victim must open a specially crafted file within Google Chrome. The CVSS vector PR:N confirms no attacker authentication is required, and AV:N confirms the file can be delivered over the network. The scope is ungrouped (S:U), meaning exploitation does not break out of the Chrome sandbox into the underlying OS. Exploitation is limited to Chrome desktop versions prior to 152.0.7977.65; updated installations are not affected. The primary limiting factor is the mandatory user interaction (UI:R) - purely passive browsing is insufficient to trigger the flaw. Additionally, the 'RCE' tag in the source intelligence has not been corroborated by the CVE description or CVSS impact metrics, which describe only confidentiality loss.

The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) signals a network-reachable, low-complexity flaw requiring no attacker privileges but mandating a single user interaction - opening a crafted file. Confidentiality impact is rated High while Integrity and Availability are unaffected, limiting the blast radius to information disclosure. EPSS at 0.19% (8th percentile) is notably low, indicating the security community currently assesses exploitation as unlikely in the near term. There is no CISA KEV listing. The 'RCE' tag in the intelligence feed conflicts with the CVE description, which describes only sensitive information disclosure - this discrepancy should be verified against the vendor advisory before escalating incident priority. The combination of low EPSS, no KEV listing, no public exploit, and an available vendor patch positions this as a routine patching priority rather than an emergency response item for most organizations.

An attacker delivers a maliciously crafted file - such as a document or archive - via email, web download, or messaging platform to a target Chrome user. The user opens the file, triggering the Bisection component to process attacker-controlled content, which injects code and causes Chrome to read and transmit sensitive local browser data (such as session tokens or cached credentials) back to the attacker-controlled infrastructure. No public exploit code exists at time of analysis, so exploitation would currently require independent vulnerability research.