Google Chrome EUVD-2026-66013

Exploitation requires that a victim user actively visits a crafted HTML page in an unpatched Chrome browser prior to version 152.0.7977.65, reflected by the CVSS UI:R metric. The attack requires no authentication (CVSS PR:N) and no special Chrome configuration or non-default feature enablement - the flaw exists in the default DOM implementation available to any web page. The primary limiting factor is mandatory user interaction: the victim must navigate to the attacker-controlled page. Exploitation impact is bounded to confidentiality only; attackers cannot modify data or disrupt service availability. The specific cross-origin data types exposed are not enumerated in available data, so defenders cannot further narrow exposure to specific page content.

CVSS 4.3 Medium is consistent with the available signals: AV:N confirms network delivery, AC:L indicates no special conditions, PR:N reflects unauthenticated access, and UI:R introduces a meaningful barrier requiring victim interaction. The impact is limited to C:L with no integrity or availability consequences. EPSS at 0.22% (12th percentile) places exploitation probability well below the threshold of active concern, and the absence of a CISA KEV listing confirms no confirmed active exploitation at time of analysis. Taken together, these signals characterize this as a genuine but lower-priority vulnerability - real confidentiality risk exists but is bounded by mandatory user interaction and limited data exposure. Chrome's auto-update mechanism and rapid patch availability further reduce real-world window of exposure for most users. No conflicting signals are present in the available data.

An attacker hosts a crafted HTML page that exploits the DOM information leak to bypass Chrome's Same-Origin Policy, then delivers the URL to a victim via phishing, malicious advertisement, or compromised website. Once the victim loads the page in an unpatched Chrome browser, attacker-controlled JavaScript reads cross-origin DOM content - potentially extracting session-related fragments, tokens, or other sensitive data rendered from a co-loaded trusted origin. No public exploit code has been identified at time of analysis.