Google Chrome EUVD-2026-66012

The sole prerequisite for exploitation is that a target user visits an attacker-controlled or compromised web page containing crafted media content - no authentication is required and no special server-side configuration is needed on the attacker's infrastructure. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network accessibility without credentials; the only gate is user interaction (UI:R), meaning silent drive-by exploitation without any user action is not possible. The vulnerability affects Chrome desktop versions prior to 152.0.7977.65; mobile Chrome or ChromeOS variants are not specified in available data and should be assessed separately. Key limiting factors: the user must actively navigate to or be social-engineered into visiting the malicious page; Chrome's layered sandbox architecture means achieving reliable code execution outside the sandbox requires chaining multiple exploit primitives, reflected in Chromium's own 'Medium' internal severity rating and SSVC's 'Automatable: no' classification, which meaningfully raises the bar for reliable mass exploitation.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) positions this as a high-severity, network-reachable flaw requiring only a single user interaction with full CIA impact. However, multiple independent signals meaningfully moderate the immediate priority: EPSS is 0.21% at the 12th percentile, placing this flaw among the least-likely-to-be-exploited CVEs currently tracked; CISA SSVC rates exploitation as 'none' and automatable as 'no,' indicating no observed active exploitation and that mass automated campaigns are not straightforward; and no CISA KEV listing exists. Notably, Chromium's own internal severity is 'Medium' - considerably below NVD's 8.8 - signaling that the Chrome security team views reliable exploitation as more constrained than the base metrics imply, likely reflecting the inherent complexity of dependably chaining a renderer bug into a clean sandbox escape. The SSVC 'total' technical impact is consistent with full OS-level code execution if the chain succeeds, but the low EPSS and no-automation signals indicate this is not being mass-exploited. The vendor-confirmed patch at 152.0.7977.65 should be applied promptly as routine hygiene, but this does not warrant emergency response protocols absent a KEV listing.

An attacker establishes a web page embedding a crafted HTML document with specially constructed media content designed to trigger the improper input validation flaw in Chrome's Media component. A user on a vulnerable Chrome version visits the page - via a phishing link, malicious advertisement, or compromised site - causing the malformed media to corrupt renderer process memory, which the attacker chains into a sandbox escape primitive to execute arbitrary code in the context of the host operating system. No public proof-of-concept has been identified at time of analysis.