Chrome Enterprise EUVD-2026-66084

The attacker must be network-adjacent (same LAN, WLAN, or equivalent Layer-2/3 segment) - remote internet-based exploitation is not possible given AV:A. The target must be running Google Chrome Enterprise (not standard consumer Chrome) on Windows, and must be using a version prior to 152.0.7977.65. High attack complexity (AC:H) means the race condition window must be hit with precise timing, which SSVC confirms is not automatable. No authentication or user interaction is required per PR:N/UI:N. Exploitation is limited by: the adjacent-only network vector (cannot traverse NAT or internet), high complexity race timing, Chrome Enterprise-specific deployment, and Windows OS requirement. Standard consumer Chrome and non-Windows platforms are not confirmed affected.

The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a base score of 7.5 but contains several moderating factors: AV:A restricts exploitation to the adjacent network segment (LAN, WLAN, or Bluetooth range), and AC:H reflects the race condition's inherent timing sensitivity, requiring precise exploitation windows that resist reliable automation. SSVC corroborates this with exploitation rated 'none' and automatable rated 'no,' while technical impact is assessed as only 'partial.' Google's own Chromium security team assigned a Low internal severity, a notable divergence from the 7.5 CVSS base score - likely reflecting their view that sandbox-escape race conditions in Chrome are difficult to reliably trigger under real enterprise conditions. No KEV listing and no public POC further reduce urgency. The primary discrepancy worth flagging is the CVSS S:U (scope unchanged) designation versus the description's explicit mention of code execution 'outside the sandbox,' which technically represents a scope boundary crossing and may understate the true C/I/A ceiling if the sandbox escape is fully realized.

An attacker positioned on the same local network segment - such as a co-located user on a corporate WLAN or an attacker who has already compromised another LAN host - sends specially crafted network traffic to a Windows machine running Chrome Enterprise. The traffic is timed to exploit a race condition in Chrome's network processing code, hitting a narrow timing window that allows execution of attacker-controlled code in a context outside Chrome's sandbox. Given AC:H and the absence of any known POC, successful exploitation requires precision timing and likely repeated attempts, making opportunistic mass exploitation unlikely.