Google Chrome EUVD-2026-66030

User interaction is required: the victim must actively visit a crafted HTML page in Chrome (UI:R from CVSS vector). High attack complexity (AC:H) means the attacker must meet specific technical preconditions - likely that the Glic component is active or initialized in the victim's browser session - rather than exploiting a universally reproducible condition. The attack is network-delivered (AV:N) with no authentication required (PR:N), meaning any Chrome user who visits the attacker's page is potentially a target, but exploitation is limited by: (1) mandatory user navigation to attacker-controlled content, (2) high complexity conditions that may require Glic to be in a specific state or the user to have interacted with it, and (3) the absence of integrity or availability impact constrains attacker objectives to information leakage only.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) presents an apparent paradox: high confidentiality impact offset by high attack complexity and mandatory user interaction, yielding a moderate 5.3 score. Real-world risk aligns with the score's lower bound: EPSS at 0.17% (7th percentile) reflects that the security research community considers exploitation unlikely in the near term, consistent with the high-complexity requirement. There is no CISA KEV listing and no public proof-of-concept identified. The 'Low' Chromium-internal severity rating further corroborates limited risk. The C:H metric should not be dismissed - successful exploitation could expose sensitive browser or AI-context data - but the AC:H and UI:R barriers significantly narrow the realistic attacker population. This is a genuine but low-urgency issue: patch in the normal update cycle rather than treating it as an emergency.

An attacker hosts a crafted HTML page designed to interact with or probe the Glic component's observable behavioral differences, then lures a target Chrome user to visit the page via phishing, malvertising, or a poisoned link. Once the victim's browser loads the page, the attacker measures discrepancies in Glic's responses - such as timing differentials or resource-loading behaviors - to infer sensitive information from the victim's browser or Glic AI context. The high attack complexity requirement means the attacker must engineer precise conditions, making opportunistic mass exploitation unlikely but targeted attacks feasible.