Google Chrome EUVD-2026-66067

Exploitation requires a victim to visit a crafted HTML page using Chrome prior to 152.0.7977.65 AND to perform an active user interaction - such as a click, drag, or paste - that invokes the vulnerable DataTransfer code path; the CVSS UI:R metric confirms passive page load is insufficient. No authentication, privileged configuration, or non-default browser settings are required. Exploitation is bounded to confidentiality of DataTransfer-accessible data (clipboard or drag buffer); attackers cannot write data, crash the browser, or affect other system components (I:N/A:N). Users running Chrome 152.0.7977.65 or later are not affected.

The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a meaningful but bounded risk: network delivery and no authentication requirement are elevating factors, but mandatory user interaction (UI:R) and zero integrity or availability impact (I:N/A:N) significantly constrain exploitability. The internal Chromium Low severity rating diverges from the CVSS C:H label - this discrepancy is not explained in available sources, but likely reflects that the leaked data is limited in sensitivity or extraction volume rather than a scoring error; defenders should note this conflict and not rely solely on CVSS. EPSS of 0.21% (11th percentile) and the absence of any CISA KEV entry or confirmed POC collectively point to a vulnerability that has not attracted attacker interest. The lack of scope change (S:U) prevents lateral movement across security boundaries, keeping blast radius confined to the browser session.

An attacker hosts a crafted HTML page that uses JavaScript to manipulate DataTransfer events - for example, synthetically triggering a drag-and-drop or intercepting a paste event - to read clipboard or drag-buffer data that the browser should not expose to the page's origin. When a victim visits the page in an unpatched Chrome version and performs a natural interaction such as clicking or dragging, the vulnerable DataTransfer handler leaks the sensitive contents to the attacker-controlled script, which can then exfiltrate them. No public exploit code has been confirmed at time of analysis.