Google Chrome EUVD-2026-66033

Exploitation requires that the victim be running Google Chrome prior to 152.0.7977.65 AND be socially engineered into installing a crafted Chrome extension - this is the non-negotiable prerequisite encoded in the UI:R CVSS metric. The attack is network-delivered (AV:N) and requires no prior authentication to Chrome or the target system (PR:N), but the social engineering step is a concrete limiting factor: the extension must be installed with user consent or via a compromised extension distribution channel. Exploitation is further limited because the impact is confidentiality-only (no code execution, no integrity impact) and is not automatable per SSVC assessment. Defenders on managed devices who enforce extension allowlisting policies are not realistically exposed.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-reachable, low-complexity attack with no privilege requirement but mandatory user interaction (UI:R) and confidentiality-only impact (C:H/I:N/A:N). Real-world risk is substantially lower than the base score implies. EPSS at 0.23% places this in the 13th percentile - well below exploitation thresholds typically associated with commodity attacks. SSVC signals reinforce this: exploitation is 'none,' the attack is not automatable, and technical impact is only 'partial.' The social engineering dependency (convincing a user to install a crafted extension) introduces a meaningful friction barrier. Chromium itself rates severity as 'Low.' No KEV listing and no public POC have been identified. The primary gap between raw CVSS and real-world risk is the non-trivial social engineering step required; this is not a drive-by or unauthenticated remote exploit.

An attacker crafts a malicious Chrome extension and distributes it via a phishing page, fake software bundle, or social media, persuading a target to install it manually. Once installed, the extension exploits the missing BrowserTag authorization check to query sensitive browser state - such as tab metadata, browsing context identifiers, or cross-origin signals - that it would not normally be permitted to access. No public exploit code has been identified at time of analysis, making mass exploitation unlikely in the near term.