Google Chrome EUVD-2026-66007

Exploitation requires the victim to actively visit a crafted HTML page - user interaction (UI:R) is mandatory and social engineering is the described delivery mechanism, meaning passive drive-by exploitation without user navigation is not possible. The victim must be running Google Chrome prior to version 152.0.7977.65 on any desktop platform. The attacker requires no authentication or elevated privileges (PR:N). Exploitation is further limited by the browser's geolocation permission system; if the flaw relies on bypassing the permission prompt, users who have previously denied geolocation to all sites may be less exposed - however, the exact bypass mechanism is not publicly confirmed. No special server-side configuration or non-default Chrome settings are described as prerequisites.

CVSS 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N classifies this as medium severity. The C:H rating reflects that geolocation data is highly sensitive personal information capable of revealing home and workplace locations. However, UI:R is a meaningful constraint - exploitation is gated on successful social engineering to direct the victim to a malicious page. EPSS at 0.21% (11th percentile) strongly suggests this is not being opportunistically or widely exploited. There is no CISA KEV listing and no confirmed POC. The combination of a high confidentiality impact with a low exploitation probability and mandatory user interaction places this as a genuine privacy risk warranting prompt patching but not emergency response escalation. No conflicting signals detected: CVSS, EPSS, and KEV status are mutually consistent in painting a moderate-priority, socially-engineered information disclosure.

An attacker registers a convincing phishing domain and hosts a crafted HTML page that exploits the Geolocation information leak in Chrome. The attacker sends a targeted phishing email or social media message directing the victim to the page; when the victim loads it in an unpatched version of Chrome, the attacker silently receives the victim's precise geolocation coordinates. No public POC has been identified, but the low technical complexity (AC:L) and social engineering delivery model make targeted attacks feasible for motivated actors.