Google Chrome EUVD-2026-66057

Exploitation requires that the victim be running Google Chrome prior to version 152.0.7977.65 and be socially engineered into visiting a crafted HTML page - user interaction (UI:R) is mandatory, meaning the attack cannot be automated without a social engineering step. No authentication to any service is required (PR:N), and the exploit works over a standard HTTPS/HTTP connection (AV:N, AC:L). Exploitation is limited to the Chrome sandbox; the attacker does not gain direct OS access without a separate sandbox escape. Non-default configurations are not required - any Chrome instance below the fixed version browsing to the malicious page is potentially vulnerable. The key limiting factor is the mandatory user interaction: victims must be directed to the malicious page, which prevents fully automated, scanning-style exploitation.

The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact with a network attack vector and no privilege requirement, but the score must be weighed against several limiting signals. First, UI:R is required - exploitation depends on social engineering to lure a victim to a malicious page, making automated mass exploitation impractical, consistent with SSVC's 'Automatable: no' finding. Second, and most significantly, Chromium's own severity rating for this issue is 'Low,' reflecting that code execution is sandboxed - an attacker who successfully exploits this flaw gains renderer-level access, not full system compromise, and would need a separate sandbox escape to reach the OS. SSVC lists exploitation status as 'none,' and there is no CISA KEV entry or known public POC. EPSS data is not provided in the input. In practice, this is a meaningful but not immediately critical finding: the realistic impact is browser-process compromise rather than host takeover, and the social engineering requirement raises the exploitation bar beyond opportunistic mass scanning. Even so, organizations that maintain unpatched browser fleets - including environments where browser updates are not centrally managed - should treat this as a priority patch, since V8 type confusion bugs are frequently chained with sandbox escapes in targeted campaigns.

An attacker crafts a malicious HTML page containing JavaScript designed to trigger the V8 type confusion bug, then distributes it via phishing email, malicious ad, or compromised website. A victim running an unpatched version of Chrome is socially engineered into visiting the page, at which point the script executes and achieves arbitrary code execution within Chrome's renderer sandbox. From the sandboxed context, the attacker could attempt to read same-origin web data, exfiltrate session cookies accessible to the renderer, or chain the flaw with a sandbox escape vulnerability to escalate to OS-level access. No public POC has been identified at time of analysis.