Google Chrome iOS EUVD-2026-66073

Exploitation requires local access to an iOS device running Google Chrome prior to version 152.0.7977.65, with the Chrome Passwords (built-in credential manager) feature in use. A crafted file must be delivered to a location accessible to the Chrome Passwords component - this limits exploitation to scenarios involving physical device access, device sharing, or local malware with filesystem privileges. User interaction (UI:R per the NVD CVSS vector) is required, meaning the victim or attacker must trigger the relevant Passwords component behavior. The vulnerability is iOS-platform-specific and does not affect Chrome on other operating systems. Remote or unauthenticated network-based exploitation is not supported by the description despite the NVD assigning AV:N - that metric assignment should be treated as unverified pending vendor clarification.

The NVD CVSS vector (AV:N/AC:L/PR:N/UI:R) conflicts with the description's explicit 'local attacker' characterization - a local attack surface does not align with AV:N, and this discrepancy meaningfully affects the base score calculation. Taking the description at face value, the real attack surface is substantially more constrained than the NVD score implies. EPSS at 0.11% (1st percentile) reflects extremely low exploitation probability, consistent with a local-access, file-dependent flaw in a mobile-specific component. The vulnerability is not in the CISA KEV catalog and no public exploit code has been identified. The Chromium security team's own Low severity designation aligns with the limited attack surface. The C:H impact is meaningful - stored passwords are highly sensitive - but the combination of local-only access, user interaction requirement, iOS-platform specificity, and minimal exploitation interest in the wild makes this a low real-world priority compared to its nominal CVSS score of 6.5.

An attacker with local access to an iOS device - through device sharing, theft, or co-located malware with filesystem access - places a crafted file in a location accessible to the Chrome Passwords component. When the Passwords subsystem processes or interacts with this file, it leaks stored credential data that the attacker can then read. No public exploit code exists at time of analysis, so exploitation currently requires attacker-developed tooling and physical or local proximity to the target device.