Google Chrome EUVD-2026-66064

Exploitation requires that the victim be running Google Chrome prior to version 152.0.7977.65 AND be socially engineered into installing a specifically crafted malicious Chrome extension - this is the explicit attack precondition stated in the CVE description. The CVSS UI:R metric confirms user interaction is mandatory; passive browsing is insufficient. The attack does not require any authenticated session on a target service. Exploitation is constrained by: (1) the user must actively install the malicious extension, which Chrome's extension permission prompts may make visible; (2) Chrome's Web Store review process creates a detection barrier if the extension is distributed through official channels; (3) the Scope:Unchanged metric means compromise is bounded to the browser's own origin isolation rather than escaping to the underlying OS. Enterprises with extension allowlisting policies, or those that disable Chrome developer mode, are not meaningfully exposed even on unpatched versions.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) captures a network-reachable, low-complexity attack with a high integrity impact, but the UI:R metric is critical: exploitation requires the victim to be socially engineered into installing a malicious Chrome extension, substantially reducing opportunistic exploitation likelihood. The EPSS of 0.24% at the 14th percentile corroborates low real-world exploitation activity. Notably, the Chromium security team internally rated this as Low severity despite the Medium CVSS base score - a discrepancy worth flagging, possibly reflecting their assessment of the practical exploit barrier imposed by the extension-install step and the limited impact scope (Scope:Unchanged). No CISA KEV listing exists and no public POC is identified. Real-world priority is therefore moderate for most enterprises: Chrome's auto-update mechanism means the patch window is typically short, but organizations with managed Chrome environments or policies restricting extension installs are at significantly reduced risk. The absence of confidentiality impact (C:N) further limits the blast radius compared to typical origin-policy bugs that enable cross-origin data theft.

An attacker publishes or directly delivers a crafted Chrome extension - for example through a phishing page, a typosquatted extension name in the Chrome Web Store, or a direct file-based install link - and socially engineers the target user into installing it on a Chrome version prior to 152.0.7977.65. Once installed and activated, the extension triggers the incomplete cleanup flaw in Chromium's origin-handling logic to operate outside its declared origin permissions, potentially modifying web content or injecting scripts into pages from other origins. No public proof-of-concept code is confirmed at time of analysis, so exploitation currently requires independent vulnerability rediscovery.