Google Chrome EUVD-2026-65994

Exploitation requires that the targeted Chrome instance is actively running the Chromoting component - meaning the user has Chrome Remote Desktop configured and a Chromoting session is established or being negotiated, making this not a default-configuration exposure for typical browser users. The CVSS vector PR:N and UI:N indicate no authentication or user interaction is needed once the attacker can reach the Chromoting network endpoint. Attack complexity is high (AC:H), meaning reliable exploitation requires careful heap shaping rather than a straightforward one-shot trigger. Exploitation is limited by: (1) Chromoting must be active - passive browser use is not affected; (2) the attacker must be able to deliver crafted network traffic to the Chromoting listener; (3) heap exploitation techniques required raise the skill bar considerably. These conditions meaningfully restrict the realistic attacker population compared to a pure browser rendering vulnerability.

The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network-reachable exploitation requiring no credentials and no user interaction, but with high attack complexity - consistent with SSVC's 'Automatable: no' determination. The AC:H metric indicates reliable exploitation requires overcoming race conditions or heap layout manipulation, which limits opportunistic mass exploitation. Despite the High CVSS, Google's internal severity label is 'Medium', suggesting their team assessed practical exploitability as constrained. SSVC reports exploitation status as 'none' and this CVE is absent from the CISA KEV catalog, further supporting the assessment that real-world exploitation has not been observed. SSVC Technical Impact is 'total', aligning with the C:H/I:H/A:H vector. The sandbox escape aspect is the primary risk multiplier - if the UAF is successfully weaponized beyond sandbox boundaries, an attacker achieves full code execution outside Chrome's isolation layer, significantly elevating post-exploitation capability. Overall: technically severe if exploited, but high complexity and no observed exploitation keep near-term operational risk moderate.

An attacker who can send crafted network traffic to a Chrome instance actively using the Chromoting (Chrome Remote Desktop) protocol triggers a use-after-free condition in the Chromoting network handler. By carefully controlling heap memory layout - requiring the high attack complexity captured in AC:H - the attacker redirects execution to attacker-controlled data, achieving arbitrary code execution outside Chrome's sandbox. No public proof-of-concept code has been identified at time of analysis, and successful exploitation would require overcoming non-trivial heap manipulation challenges.