Google Chrome EUVD-2026-66003

Exploitation requires the victim to be running Google Chrome prior to version 152.0.7977.65 and to be successfully persuaded via social engineering to navigate to a crafted HTML page - CVSS UI:R confirms that user interaction is mandatory and non-bypassable. The attack is network-delivered (AV:N) and requires no privileges from the attacker (PR:N), but the social engineering dependency prevents automatable mass exploitation, confirmed by SSVC automatable: no. Code execution is constrained within the Chrome sandbox (S:U); lateral movement or host compromise would require a secondary sandbox escape exploit not described in this CVE. There is no indication from the description or references that DevTools must be explicitly open by the user, that a specific browser setting must be enabled, or that a particular OS platform is required - the flaw appears triggerable through a crafted page that internally invokes the vulnerable DevTools code path.

The CVSS 8.8 base score reflects high C/I/A impact with a network attack vector and no privilege requirement, but UI:R (mandatory user interaction via social engineering) and S:U (sandbox-contained scope) meaningfully reduce real-world risk compared to a no-interaction, scope-changing flaw. EPSS at 0.21% (12th percentile) signals very low current exploitation probability, consistent with SSVC's designation of exploitation status as 'none' and automatable as 'no' - both indicating this does not represent an active or mass-exploitation threat at time of analysis. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. SSVC does classify technical impact as 'total,' which aligns with the arbitrary code execution capability within the browser process. The overall picture is a high-severity-class flaw with currently low exploitation risk: appropriate for priority patching in a normal patch cycle rather than emergency response, absent future changes in KEV listing or public POC release. No conflicting signals between data sources are present; EPSS and SSVC are consistent with each other and with the absence of KEV listing.

An attacker hosts a crafted HTML page engineered to trigger the control flow defect in Chrome's DevTools subsystem, then uses phishing email, malicious advertising, or social media link-sharing to direct a target running an unpatched Chrome instance to the page. Upon the victim loading the page, the DevTools vulnerability fires and enables execution of attacker-controlled code within the Chrome sandbox. No public proof-of-concept code has been identified; achieving host-level impact beyond the sandbox would require chaining with a separate sandbox escape exploit.