Google Chrome EUVD-2026-66074

A crafted Chrome extension must be present and active in the victim's browser; the attacker cannot exploit this vulnerability without the user first installing or interacting with the malicious extension. The CVSS UI:R metric confirms user interaction is mandatory - passive network exposure alone is insufficient. PR:N indicates no special attacker-side privileges are required to create or distribute the extension. SSVC's 'not automatable' classification further confirms that exploitation cannot be scripted at scale against arbitrary targets. Limiting factors: the victim must voluntarily install the malicious extension, and the race condition window must be successfully timed against Chrome's extension subsystem execution order - both conditions reduce realistic exploitation rate relative to simpler vulnerability classes.

Multiple signals converge on low real-world risk. CVSS 6.5 (Medium) with AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N describes network-reachable exploitation with no required privileges but mandatory user interaction; integrity impact is high but confidentiality is unaffected. However, Chromium's internal severity is rated Low, which frequently reflects the difficulty of reliable exploitation in a TOCTOU scenario - race windows in a heavily optimized browser engine are hard to win consistently. EPSS at 0.22% (12th percentile) indicates extremely low observed exploitation likelihood. SSVC confirms exploitation status as 'none,' technical impact as 'partial,' and the vector as not automatable. No KEV listing exists. The discrepancy between the NVD AC:L assignment and the inherently timing-dependent nature of race condition exploitation is notable - reliable weaponization would likely require AC:H in practice. Net assessment: low operational priority absent specific threat intelligence, though Chrome's ubiquitous deployment warrants timely patching as a routine hygiene measure.

An attacker distributes a malicious Chrome extension - potentially via the Chrome Web Store with a benign-appearing use case - that is engineered to exploit a race window in the Extensions permission validation subsystem. When a target user installs or interacts with the extension, the crafted extension races the permission check to perform a privileged operation that would normally be blocked by system access restrictions, achieving unauthorized integrity impact. No public exploit code exists at time of analysis, and reliable exploitation of the race window is expected to require careful timing, limiting mass exploitation potential.