Google Chrome EUVD-2026-66045

Exploitation requires that the attacker has already compromised the Chrome renderer process through a separate, unrelated vulnerability - this is an explicit precondition stated in the CVE description ('remote attacker who had compromised the renderer process'). Additionally, user interaction is required (UI:R per CVSS), meaning a victim must visit or be redirected to a crafted HTML page. The vulnerability is Windows-specific; Chrome on macOS, Linux, or mobile platforms is not named as affected. These two limiting factors - prior renderer compromise and user interaction - mean this cannot be exploited as a standalone remote attack against default Chrome configurations.

CVSS 3.1 scores this at 6.5 (Medium) with AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, but that vector materially overstates ease of exploitation: the official description requires prior renderer process compromise, a significant pre-condition that AC:L does not capture. Chromium's own severity rating is Low. EPSS at 0.18% (8th percentile) corroborates low real-world exploitation probability. No CISA KEV listing and no public POC have been identified. The actual risk is best understood as a component in an exploit chain - an attacker who has already broken the renderer sandbox may leverage this to further cross-origin boundaries, but this vulnerability alone does not grant initial access. Security teams should prioritize patching as part of routine Chrome update cadence rather than treating this as an emergency response item.

An attacker who has separately exploited a renderer-process vulnerability in Chrome on Windows crafts an HTML page that feeds malformed input to the NTP Footer component; the validation failure allows cross-origin policy to be circumvented, enabling the attacker to read or manipulate content belonging to a different web origin from within the already-compromised renderer. No public POC exists, so this scenario requires chaining with an independent renderer exploit, substantially raising the bar for real-world exploitation.