Google Chrome EUVD-2026-66078

Exploitation requires a victim running Google Chrome prior to 152.0.7977.65 to visit an attacker-controlled or attacker-influenced HTML page - confirmed by the CVSS UI:R (user interaction required) metric. The attacker requires no authentication (PR:N) and no pre-existing access to the victim's system. The scope is unchanged (S:U), meaning exploitation is confined to the Chrome renderer context and does not directly escape to the OS. The specific Forms feature configuration or autofill state that amplifies impact is not detailed in available data; it is inferred from CWE-863 that some form-associated permission boundary is not enforced correctly. Limiting factors: passive drive-by without navigation is insufficient; the victim must load and render the crafted page; impact is limited to confidentiality with no integrity or availability consequence.

The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N presents a network-reachable, low-complexity flaw requiring only a single user click or navigation event - a realistic social engineering threshold. The high confidentiality rating is notable: if exploited, an attacker could read sensitive form content (credentials, PII, tokens) that Chrome stores or processes. However, several signals moderate real-world urgency: EPSS of 0.17% places this in the bottom 6th percentile of exploitation likelihood; Chromium's own security team rated it 'Low' internally, suggesting the data exposed in practice may be narrow in scope or the triggering conditions are restrictive; no CISA KEV listing exists; and no public POC has been reported. The Chromium 'Low' versus NVD 6.5 CVSS discrepancy is worth noting - defenders should treat this as a routine patch-cycle priority rather than an emergency response, while still confirming the update is deployed given Chrome's ubiquitous footprint.

An attacker hosts a crafted HTML page and distributes its URL via phishing email or malicious advertisement, targeting Chrome users on vulnerable versions prior to 152.0.7977.65. When the victim navigates to the page, JavaScript or HTML form constructs exploit the incorrect authorization check in Chrome's Forms component to read sensitive data - such as autofilled credentials or previously entered form values - and exfiltrate it to an attacker-controlled server. No public POC has been identified at time of analysis, and exploitation requires the victim to actively visit the malicious URL.