Google Chrome EUVD-2026-66079

Exploitation requires the victim to actively visit a crafted HTML page controlled by the attacker (UI:R per CVSS vector), making passive drive-by exploitation without any user navigation impossible. The attacker requires no authentication or privileges on any system (PR:N). The victim must be running Google Chrome prior to version 152.0.7977.65 on any supported desktop platform. Exploitation is limited to confidentiality impact only - no code execution, no integrity modification, and no availability disruption are possible through this vulnerability. The scope is unscopped (S:U), meaning impact is contained to the victim's browser context and does not pivot to other systems. The specific DOM feature or API path that triggers the authorization bypass is not disclosed in available data, which further limits opportunistic exploitation.

The NVD CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a high confidentiality impact, but several signals materially lower the realized risk. EPSS at 0.17% (6th percentile) indicates very low observed exploitation probability relative to the broader vulnerability population. There is no CISA KEV listing and no confirmed public exploit code. Chrome's own security team rated this 'Low' severity, suggesting the leakable information is constrained in scope or the triggering conditions are harder than the AC:L metric implies. The UI:R requirement means passive users who do not visit a malicious page are not at risk. Overall, this is a real but low-urgency issue: patch during normal update cycles rather than emergency response. The high C:H metric is the primary concern but must be weighed against the absence of any exploitation signal.

An attacker registers a domain and hosts a crafted HTML page that exploits the DOM authorization flaw to read cross-origin or otherwise restricted data from the victim's browser session. The attacker distributes a link via phishing email or social media; when a Chrome user on an unpatched version visits the page, the browser incorrectly permits the page's JavaScript to access sensitive information and exfiltrate it to the attacker's server. No public proof-of-concept exists at time of analysis, making opportunistic exploitation unlikely in the near term.