Google Chrome EUVD-2026-66001

Exploitation requires active user interaction: the victim must be social-engineered into visiting a crafted HTML page (UI:R per CVSS vector). No authentication or privileges are required from the attacker's side (PR:N). Code execution is confined to the Chrome sandbox (S:U - scope unchanged), meaning a full host OS compromise would require a separate sandbox escape chained after this bug. The vulnerability is in the DevTools component; it is not confirmed from available data whether DevTools must be explicitly open by the user or whether the crafted page can interact with DevTools programmatically to trigger the flaw - this distinction meaningfully affects exploitability and defenders should monitor the Chromium issue tracker (https://issues.chromium.org/issues/532162132, likely restricted). Exploitation is not automatable per SSVC, meaning worm-like or fully automated mass exploitation is not expected.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high theoretical severity: network-delivered, low complexity, no privileges required, and full impact on the sandboxed process. However, multiple signals temper this: UI:R requires user interaction via social engineering (not zero-click), S:U confirms the exploit remains sandboxed and does not automatically escape to the host OS, and the SSVC framework rates exploitation as 'none' and automatable as 'no'. EPSS data was not provided in the input - its absence means exploitation probability cannot be quantified. The combination of no KEV listing, no public POC, and SSVC 'exploitation: none' suggests this is a medium operational priority despite the high CVSS score. Defenders should prioritize patching workstations where Chrome is exposed to untrusted web content, but this is not a drop-everything emergency absent evidence of active exploitation.

An attacker hosts a crafted HTML page engineered to trigger a type confusion condition in Chrome's DevTools component, then lures the target through phishing, malvertising, or social media to visit the page. Once the victim loads the page in an unpatched Chrome browser, the type confusion flaw is triggered, allowing the attacker to execute arbitrary code within the Chrome renderer sandbox. No public proof-of-concept exploit code has been identified at time of analysis, making opportunistic mass exploitation less likely in the near term.