Google Chrome EUVD-2026-66017

Exploitation requires that the victim actively visit a crafted HTML page in an affected Chrome browser (version prior to 152.0.7977.65), confirmed by CVSS UI:R. No authentication, server-side misconfiguration, or special Chrome setting is required - Chrome's default installation is susceptible. Exploitation is limited to users running Chrome on the desktop; Chromium-based browsers (Edge, Brave, Opera) may be independently affected depending on their upstream patch cadence but are not confirmed by this CVE's scope. Exploitation is further limited in real-world impact by the S:U scope (no process escape) and C:L impact (partial data disclosure, not full cross-origin read), and by Chrome's Site Isolation feature which compartmentalizes renderer processes by origin.

The CVSS 3.1 base score of 4.3 (Medium) reflects a meaningful but constrained flaw: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The attack is network-based with no complexity barrier and no authentication requirement, but mandatory user interaction (UI:R - victim must visit the crafted page) and limited confidentiality impact (C:L) cap practical risk. No scope change occurs (S:U), meaning the attacker cannot pivot to other browser processes or the OS. EPSS at 0.19% (8th percentile) is very low, reinforcing that this is not being actively leveraged at scale. The vulnerability is not listed in CISA KEV and no POC availability is reported, making this a medium-priority patch rather than an emergency response item. Risk is primarily to users who may be targeted by spear-phishing campaigns pointing to attacker-controlled pages.

An attacker hosts a specially crafted HTML page that triggers Chrome's incorrect authorization check, causing the browser to improperly evaluate origin permissions. The attacker lures a target user to visit this page via a phishing link or a malicious ad, at which point the browser incorrectly permits cross-origin data reads that the same-origin policy should block. No public exploit code has been identified, so successful exploitation currently requires attacker-developed tooling.