Google Chrome EUVD-2026-66014

The sole prerequisite is that the target user visits a crafted HTML page using Google Chrome prior to version 152.0.7977.65; no authentication, special configuration, or non-default settings are required. The flaw resides in the core HTML parser invoked for all web content, meaning any standard browsing session is potentially vulnerable. Exploitation is bounded by the renderer sandbox (S:U scope unchanged) - an attacker achieving RCE in the renderer cannot directly access the host OS without a separate sandbox escape vulnerability. Limiting factors: user interaction is required (UI:R, the user must actively navigate to or be redirected to the malicious page); Chrome versions 152.0.7977.65 and later are not affected; and no automated exploitation path exists per SSVC 'automatable: no'.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects realistic exploitation mechanics: network-reachable, low complexity, no privileges, and only passive user interaction (visiting a page). High C/I/A impact is scoped to the renderer process given S:U. EPSS at 0.21% (12th percentile) is notably low for a high-severity Chrome RCE, suggesting limited current attacker tooling or exploitation infrastructure - possibly because the sandbox confinement reduces immediate weaponization value. CISA SSVC corroborates: exploitation rated 'none', automatable 'no', technical impact 'total'. The 'automatable: no' designation is consistent with UI:R - mass exploitation via automated scanning is not viable; social engineering or ad-network delivery is required. No CISA KEV listing and no public POC have been identified. The principal risk gap between raw score and real-world urgency is the sandboxed impact boundary - organizations should still patch promptly given the ubiquitous browser footprint, but this is lower urgency than a full sandbox-escaping chain.

An attacker registers or compromises a web property and embeds a crafted HTML document designed to trigger illegal state transitions in Chrome's parser during page rendering. A target user is delivered the URL via phishing email, malvertising injection, or a watering-hole attack on a legitimate site; upon visiting the page in an unpatched Chrome instance, the parser flaw is triggered and arbitrary code executes within the renderer sandbox. No public POC has been identified, and the SSVC 'automatable: no' rating indicates mass exploitation infrastructure does not currently exist.