Google Chrome EUVD-2026-66000

The victim must be running Google Chrome prior to version 152.0.7977.65 on any supported desktop platform (Windows, macOS, or Linux). The attacker must induce the user to visit a crafted HTML page - a single passive page load is sufficient per the CVE description (UI:R). No authentication, elevated configuration, or special browser settings are required from the attacker's side, as the CVSS vector confirms PR:N and AC:L. The critical limiting factor is that code execution is scoped inside the Chrome sandbox (S:U in the CVSS vector), meaning the attacker reaches the renderer process only, not the underlying OS, without a separate sandbox escape. Additionally, SSVC's Automatable: none rating indicates that mass automated delivery is constrained by the required user navigation step, limiting drive-by exploitation scale relative to fully wormable vulnerabilities.

The CVSS 8.8 score is driven by the network delivery vector, low attack complexity, absence of required attacker privileges, and high C/I/A impact, making this appear as a high-priority issue on raw score alone. However, several signals meaningfully temper urgency. The Chrome security team internally rated this as Medium severity, suggesting the sandbox containment is viewed as a significant mitigating factor - renderer-level compromise is a serious but bounded impact without a chained sandbox escape. SSVC assessment records Exploitation: none (no confirmed active exploitation or KEV listing) and Automatable: no (mass automated delivery is not feasible given the required user interaction), though Technical Impact is total within the affected process scope. EPSS data was not provided in the intelligence sources, so probabilistic exploitation likelihood cannot be quantified. No POC has been identified. The aggregate picture is a credible, high-quality vulnerability warranting prompt patching - particularly given Chrome's ubiquitous deployment - but not one presenting evidence of active mass exploitation at this time.

An attacker registers or compromises a website and serves a crafted HTML page containing JavaScript designed to trigger a use-after-free condition in Chrome's V8 engine during object lifecycle transitions. A user running an unpatched Chrome version visits the page via a phishing email link, malicious advertisement, or compromised legitimate site, causing the renderer process to dereference freed memory and transfer control flow to attacker-supplied shellcode executing within the Chrome sandbox. No public exploit code has been identified at time of analysis, but successful renderer compromise could serve as the first stage of a two-vulnerability chain if paired with a separate Chrome sandbox escape.