Google Chrome EUVD-2026-66054

Exploitation requires a victim to actively visit a crafted HTML page hosted by the attacker (UI:R - active user interaction is mandatory; drive-by exploitation via passive page load alone is insufficient without the user navigating to the malicious URL). No authentication, installed software beyond Chrome itself, or non-default browser configuration is required. The limiting factors are: (1) the attacker must successfully social-engineer the victim into visiting the page, (2) impact is restricted to UI deception with no code execution or data exfiltration capability inherent to this flaw, and (3) Chrome's sandboxing and same-origin policy are not bypassed. Exploitation is further constrained to Chrome desktop users running versions below 152.0.7977.65; patched or auto-updated instances are not affected.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects a network-accessible, low-complexity attack that nonetheless requires active user interaction and delivers only limited integrity impact. Chromium's own team rates this as Low severity, consistent with the constrained impact. EPSS at 0.22% (12th percentile) corroborates a low exploitation probability in the wild. There is no CISA KEV listing and no public exploit code identified at time of analysis, making this a low real-world priority. The primary risk vector is as a phishing amplifier: an attacker who can convince a user to visit a page gains a UI deception primitive, but cannot exfiltrate data, execute code, or deny service through this flaw alone. Security teams should treat this as a routine patch-cycle item rather than an emergency response trigger, unless the deployment environment involves unusually high phishing exposure.

An attacker registers a convincing lookalike domain and hosts a crafted HTML page that exploits the rendering flaw to overlay or replace visible Chrome UI elements - such as an address bar segment or a security lock icon - with attacker-controlled content. A victim lured to the page via phishing email or malicious redirect sees what appears to be a trusted origin, submits credentials or sensitive information, and the attacker captures it through a backend form handler. No public exploit code currently implements this scenario.