Google Chrome EUVD-2026-66040

Exploitation requires a user running an unpatched version of Google Chrome (any version prior to 152.0.7977.65) to visit a crafted HTML page under attacker control, as confirmed by the UI:R metric in the CVSS vector. No authentication or special user privileges are needed from the attacker (PR:N), and no special browser configuration beyond a standard default install is indicated - the Controls component is part of core Chrome. Exploitation is strictly limited by the user-interaction requirement: passive or automated network-level exploitation without user navigation is not possible. Impact is bounded to limited integrity effects (cross-origin policy bypass enabling unauthorized writes or state changes); confidentiality and availability are not impacted per the CVSS vector (C:N/A:N), limiting the practical damage an attacker can achieve even upon successful exploitation.

The CVSS 3.1 score of 4.3 (Medium) is driven by network accessibility (AV:N) and no required privileges (PR:N), but is substantially tempered by required user interaction (UI:R) and impact confined to limited integrity (I:L) with no confidentiality or availability breach (C:N/A:N). The Chromium security team's own Low internal severity rating aligns with this restrained impact profile. EPSS at 0.19% (8th percentile) indicates exploitation is unlikely in the near term relative to the broader CVE population. No CISA KEV listing and no known POC further reduce urgency. Real-world risk is low for most organizations - the combination of user-interaction requirement, integrity-only impact, and low EPSS makes this a routine patch cycle item rather than an emergency. The primary population at risk is unpatched Chrome users who encounter malicious HTML through phishing or malvertising.

An attacker registers a malicious domain and serves a crafted HTML page that exploits the incorrect authorization logic in Chrome's Controls component. A target user is lured to visit this page - via phishing email link or malicious advertisement - and upon interacting with the page, the origin policy check is bypassed, allowing the page to perform limited cross-origin write operations against content from a different origin that would otherwise be protected. No public exploit code has been identified at time of analysis.