Google Chrome EUVD-2026-66063

The victim must be running Google Chrome prior to version 152.0.7977.65. Exploitation is contingent on user interaction - the victim must visit a crafted HTML page delivered via social engineering (phishing, malicious link), as confirmed by UI:R in the CVSS vector. The attacker requires no authentication or elevated privileges (PR:N). The exploitable condition is the ReaderMode feature being accessible in the browser, which is enabled by default in Chrome. Impact is strictly limited to integrity (I:L) - cross-origin content injection into a privileged ReaderMode page - with no confidentiality leakage or availability disruption. Exploitation does not affect systems outside the browser process (S:U).

The CVSS 4.3 Medium rating reflects a genuinely constrained vulnerability: network-reachable (AV:N), low complexity (AC:L), no attacker privileges required (PR:N), but requiring explicit user interaction (UI:R) and producing only limited integrity impact (I:L) with unchanged scope and no confidentiality or availability effect. EPSS at 0.26% places this in the 17th percentile - well below the threshold that typically correlates with active exploitation campaigns. The absence of a CISA KEV entry and the lack of any public POC corroborate this low-risk signal. Chrome's own team rates this 'Low' severity, which is consistent across all available data sources. There is no conflict between CVSS vector and description; both agree on the social-engineering delivery and limited impact. This is not a priority for emergency patching outside of standard patch cycles, though the ubiquity of Chrome means even low-severity flaws warrant timely remediation.

An attacker crafts a malicious HTML page that triggers Chrome's ReaderMode input validation flaw and distributes it via phishing email or a compromised link, relying on social engineering to persuade a target running an unpatched Chrome version to open it. Upon visiting the page, the crafted content bypasses the web origin policy, allowing injection of attacker-controlled material into the privileged ReaderMode context. No public exploit code exists at time of analysis, limiting this vector to more sophisticated actors.