What is the CVSS score of EUVD-2026-65993?

EUVD-2026-65993 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-65993?

Yes, a patch is available for EUVD-2026-65993. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-65993

| CVE-2026-79265 MEDIUM

Incomplete Cleanup (CWE-459)

2026-08-25 Chrome

GHSA-6xc6-gr29-x5mg

Google Information Disclosure

5.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

AV:N and UI:R for web-delivered social engineering; AC:H for mandatory renderer-compromise prerequisite; C:H for sensitive media data exposure; no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 26, 2026 - 19:36 vuln.today

CVSS changed

Aug 26, 2026 - 19:23 NVD

5.3 (MEDIUM)

CVE Published

Aug 25, 2026 - 20:10 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 25, 2026 - 20:10 cve.org

MEDIUM 5.3

DescriptionCVE.org

Incomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Incomplete cleanup in Chrome's GetUserMedia API exposes sensitive information to remote attackers who have already compromised the renderer process. Affected versions are all Chrome releases prior to 152.0.7977.65 on desktop platforms. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Compromise Chrome renderer via separate vuln

Delivery

Serve crafted HTML page to target

Exploit

Social-engineer user to grant media permissions

Execution

Trigger GetUserMedia incomplete cleanup

Persist

Read residual sensitive media data from renderer memory

Impact

Exfiltrate information to attacker

Access

Compromise Chrome renderer via separate vuln

Delivery

Serve crafted HTML page to target

Exploit

Social-engineer user to grant media permissions

Execution

Trigger GetUserMedia incomplete cleanup

Persist

Read residual sensitive media data from renderer memory

Impact

Exfiltrate information to attacker

Vulnerability AssessmentAI

Exploitation	Exploitation requires two cumulative prerequisites: (1) the attacker must have already achieved code execution within the Chrome renderer process, likely through a separate, preceding vulnerability - this is a high-complexity chained attack, not a standalone exploit; and (2) the attacker must successfully social-engineer the target user into visiting or interacting with a crafted HTML page, satisfying the UI:R requirement in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) accurately captures the tension between high confidentiality impact and the exceptional prerequisite barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who has already gained code execution within a Chrome renderer process - for example through a separate, chained renderer bug - serves a crafted HTML page that invokes the GetUserMedia API and then triggers the incomplete cleanup path. By socially engineering the target user into interacting with the page (e.g., granting camera or microphone permission via a fake video-call prompt), the attacker causes Chrome to leave sensitive media buffer data or stream state accessible in the renderer's memory. …
Remediation	Update Google Chrome to version 152.0.7977.65 or later - this is the vendor-released patch per the stable channel update advisory at chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report.