Google Chrome EUVD-2026-66026

Exploitation requires the victim to visit a specially crafted HTML page using Google Chrome prior to 152.0.7977.65; no elevated privileges or special browser configuration are required, as WebRTC is active by default in all Chrome installations. The CVSS vector confirms network delivery (AV:N) with no authentication requirement (PR:N), but user interaction is mandatory (UI:R) - the victim must navigate to the attacker-controlled page. Code execution is constrained to the Chrome renderer sandbox (Scope:Unchanged, S:U in CVSS), meaning the flaw alone does not grant operating system access; a chained sandbox escape would be necessary for full system compromise. There are no additional deployment-specific prerequisites: any user running a vulnerable Chrome version on any OS browsing to the crafted page satisfies the conditions.

The CVSS 8.8 base score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) captures the theoretical severity of the flaw but must be weighed against converging signals that suggest low near-term exploitation likelihood. EPSS places the 30-day exploitation probability at just 0.35% (28th percentile), and the SSVC framework designates exploitation as 'none' with automatable set to 'no,' indicating this is not trivially scriptable at scale even though technical impact is rated 'total.' A critical contextual data point is the discrepancy between CVSS 8.8 and Google's own internal Chromium severity rating of 'Low' - this likely reflects the sandbox boundary limiting real-world blast radius and potentially low exploit reliability. Execution confined to the renderer sandbox (S:U) means a full system compromise requires chaining with a separate sandbox escape. No CISA KEV listing and no public POC code have been identified, further reducing near-term priority for most organizations. This is a case where the raw CVSS score overstates practical urgency relative to all other available signals.

An attacker hosts a specially crafted HTML page embedding WebRTC session negotiation data designed to trigger the integer overflow in Chrome's WebRTC parser. A victim is directed to the page via a phishing link, malvertising redirect, or compromised website, causing heap memory corruption in the renderer process that an attacker leverages for code execution within the Chrome sandbox. No public exploit code exists at time of analysis, and achieving OS-level impact beyond the sandbox would require a separate sandbox escape vulnerability chained to this flaw.