Google Chrome EUVD-2026-65997

Exploitation requires an unpatched version of Google Chrome (prior to 152.0.7977.65) and active user interaction: the victim must navigate to the attacker's crafted HTML page (UI:R per CVSS), making passive network interception insufficient. The attacker requires no authentication against any target system (PR:N per CVSS). The cross-origin data accessible to the ServiceWorker is constrained by what the victim's browser session can reach, so the practical value of the leaked data depends on the victim's authenticated sessions and the pages they visit. Non-Chrome browsers are not confirmed affected; other Chromium-based browsers sharing the same ServiceWorker engine version may be vulnerable but are not referenced in available data. No special server-side configuration is required - the flaw is entirely client-side in the browser's ServiceWorker implementation.

The CVSS 4.3 score accurately reflects the constrained scope: confidentiality-only partial impact (C:L), no scope change (S:U), and a mandatory user-interaction prerequisite (UI:R) that eliminates purely opportunistic or automated mass exploitation. EPSS at 0.17% in the 7th percentile is consistent with a medium-severity browser bug that has not attracted exploit tooling - this is a real-priority patch for organizations with cross-origin data-isolation requirements, but does not warrant emergency out-of-band response absent KEV listing or POC emergence. The attack vector is network-accessible with no authentication required (PR:N), meaning any internet-accessible user who browses to a malicious page is theoretically at risk, though the attacker must successfully deliver and have the victim navigate to that page. No conflicting signals between CVSS and description were identified: AV:N is consistent with web-delivered exploitation, UI:R is consistent with requiring the victim to visit the crafted page, and C:L matches a partial cross-origin information leak rather than full credential or session theft. The absence of KEV listing and low EPSS argue against treating this as an emergency escalation for most organizations; standard patch-cycle deployment of Chrome 152.0.7977.65 is the appropriate response.

An attacker hosts a malicious web page containing JavaScript that registers a crafted ServiceWorker designed to intercept cross-origin fetch requests and relay response data back to an attacker-controlled endpoint. A victim using an unpatched Chrome browser navigates to the attacker's page - via a phishing link, malvertising, or a compromised third-party site - triggering the ServiceWorker registration, after which cross-origin data accessible in that browsing context leaks to the attacker. No public exploit code is identified at time of analysis.