Google Chrome EUVD-2026-66025

Exploitation requires the victim to actively navigate to a crafted HTML page controlled by the attacker - user interaction is mandatory per UI:R in the CVSS vector. The attacker requires no authentication or privileges on the target system (PR:N). The vulnerability is present in all Chrome installations prior to version 152.0.7977.65 regardless of platform or configuration; no non-default settings are required to be exposed. Exploitation is bounded to a partial integrity impact (I:L) with no confidentiality or availability consequences, and scope does not change beyond the browser context (S:U). The primary limiting factors for realistic exploitation are the required user interaction and the narrow impact - unauthorized system access restriction bypass with no data exfiltration or service disruption component, reducing attacker incentive relative to higher-impact Chrome CVEs.

Real-world risk is low despite the network-reachable attack vector. CVSS 4.3 reflects the inherent accessibility of web-delivered attacks (AV:N, AC:L, PR:N) but is tempered by mandatory user interaction (UI:R) and a narrow impact scope - integrity only, no confidentiality or availability loss. EPSS at 0.19% places this in the 8th percentile, indicating statistically minimal observed or predicted exploitation activity. The vulnerability is absent from CISA KEV and no POC code is referenced in available intelligence. Chromium's own severity classification is Low. The combination of required user interaction, limited impact, low EPSS, and no known exploits makes this a low operational priority. Defenders should treat this as a routine patch-cycle item rather than an emergency response.

An attacker establishes a malicious website hosting a crafted HTML page that exploits the flawed authorization logic in Chrome's WebProtect component. When a victim running an unpatched Chrome version navigates to the page - through phishing, malvertising, or a compromised link - the crafted content triggers the authorization bypass, allowing the attacker to circumvent a system access restriction and achieve limited integrity impact on the victim's session. No proof-of-concept code has been identified in available data, and the low EPSS score suggests this scenario has not been broadly operationalized.