Google Chrome EUVD-2026-66027

Exploitation requires two concrete preconditions: the victim must be running Google Chrome prior to version 152.0.7977.65, and must be successfully socially engineered into visiting an attacker-controlled crafted HTML page (UI:R per CVSS). No authentication, no special configuration, and no elevated privileges are required on either the attacker or victim side (PR:N). The primary limiting factor is the High attack complexity (AC:H) - winning the TOCTOU race condition depends on precise timing that cannot be guaranteed, making reliable exploitation difficult even under ideal conditions. Scope is unchanged (S:U), meaning exploitation is bounded to the victim's own browser session with no lateral movement to other systems. No platform-specific or feature-flag prerequisites are documented beyond standard Chrome browser usage.

The CVSS Medium score of 5.3 is driven primarily by a High confidentiality impact, but the remaining metrics substantially constrain real-world exploitability: AC:H demands precise race-condition timing that is inherently unreliable, and UI:R means the attack cannot proceed without a victim actively visiting the attacker's page. The EPSS score of 0.14% at the 4th percentile indicates that across the broader threat landscape this vulnerability attracts negligible observed exploitation interest. There is no CISA KEV listing and no publicly known proof-of-concept code, both of which align with the vendor's own Low Chromium severity designation. The practical risk profile is low - Chrome's ubiquitous auto-update mechanism means most users will receive the fix passively within days of release, and even a mid-sized organization without centralized patch management should find Chrome 152.0.7977.65 broadly deployed before targeted exploitation of this race condition becomes operationally feasible for a threat actor.

An attacker crafts a malicious HTML page that embeds JavaScript designed to trigger a precise timing window in Chrome's Editing component - for example, by rapidly toggling editable regions while racing a read operation against a security boundary check. The victim is lured to the page via a phishing email or malicious advertisement, loading it in an unpatched Chrome browser and allowing the attacker to potentially extract sensitive in-browser data such as content from cross-origin frames or protected memory regions. The High attack complexity (AC:H) means exploitation is unreliable and requires repeated attempts or carefully tuned timing, reducing the practical threat compared to lower-complexity disclosure flaws.