Google Chrome EUVD-2026-66070

The victim must visit an attacker-controlled or compromised web page using an unpatched version of Google Chrome (any version prior to 152.0.7977.65); this is the sole prerequisite. No authentication, no special Chrome extension, no non-default configuration is required. The CVSS vector confirms PR:N (no authentication) and UI:R (one user action - visiting the page - is sufficient). Exploitation is limited to code execution within Chrome's renderer sandbox (S:U); a second, separate vulnerability would be needed to escape the sandbox and affect the underlying host OS. Chromium's own Low severity rating explicitly acknowledges this sandbox boundary as a significant limiting factor on real-world impact.

The CVSS 3.1 base score of 8.8 (High) reflects network reachability, no authentication, and full confidentiality, integrity, and availability impact within the affected scope, but the Unchanged scope (S:U) and Chromium's own Low severity designation both signal that impact is bounded to the browser sandbox. SSVC categorisation (Exploitation: none, Automatable: no, Technical Impact: total) further clarifies the picture: total technical impact within the sandbox, but not yet automated or actively exploited. EPSS data is not provided. No CISA KEV listing and no public exploit code have been identified, making this a credible but not immediately weaponised threat. The key tension is that NVD C:H/I:H/A:H scores against the full system while Chromium's Low severity acknowledges that sandbox containment fundamentally limits blast radius. Real-world prioritisation should treat this as a high-priority patch for exposed user populations but not an emergency incident unless a sandbox escape is later chained to it.

An attacker hosts a malicious web page containing crafted JavaScript that triggers the V8 use-after-free condition, then distributes the link via phishing email or malvertising. When a victim running an unpatched Chrome version visits the page, V8 processes the script, a freed memory region is reused with attacker-controlled data, and arbitrary code executes within the Chrome renderer sandbox. No public exploit code has been identified at time of analysis, meaning exploitation currently requires non-trivial V8 exploitation expertise.