Google Chrome EUVD-2026-66062

Exploitation requires the victim to actively visit a crafted HTML page in a Chrome browser version prior to 152.0.7977.65, making user interaction (UI:R) a hard prerequisite - drive-by exploitation without a browser visit is not possible. The vulnerability is scoped to the FoldableAPIs component, which surfaces meaningful data only on foldable-form-factor devices (e.g., devices with physical fold/hinge hardware); on conventional non-foldable endpoints, the API may return empty or trivial data, materially limiting the value of any leak. No authentication is required from the attacker (PR:N in the CVSS vector). Limiting factors include the UI:R requirement, the foldable-device dependency for meaningful data exposure, and the absence of any known automated exploitation path per SSVC Automatable: no.

The CVSS 6.5 Medium vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) characterizes this as a low-complexity, network-reachable information disclosure requiring only a browser visit, with High Confidentiality impact - however, multiple secondary signals collectively argue for a lower real-world priority. EPSS is 0.21% at the 11th percentile, indicating very low exploitation probability relative to the broader vulnerability population. SSVC rates Exploitation: none, Automatable: no, and Technical Impact: partial, all of which are inconsistent with an imminent mass-exploitation scenario. The C:H rating in the CVSS vector conflicts with Chromium's own internal 'Low' severity classification and the SSVC 'partial' technical impact finding, suggesting the disclosed data is of limited sensitivity or real-world utility to an attacker. The UI:R requirement also prevents fully automated exploitation. The vulnerability is not in CISA KEV and no public exploit code has been identified. Overall, while the network-reachable, zero-auth attack surface warrants prompt patching in the normal Chrome update cycle, this does not meet the threshold for emergency out-of-band response for most organizations.

An attacker registers or compromises a web domain and serves a crafted HTML page containing JavaScript that invokes FoldableAPIs to read cross-origin device-geometry data from the victim's unpatched Chrome browser on a foldable device. The victim is directed to the page via phishing, malvertising, or a compromised link, and upon visit the sensitive API data is silently exfiltrated to the attacker's server. No public exploit code has been identified, making opportunistic mass exploitation unlikely at this time.