Google Chrome EUVD-2026-66085

Exploitation requires that the victim is running Google Chrome on Windows (not Linux or macOS, which are not identified as affected). The attacker must successfully social-engineer the victim into visiting a crafted HTML page - passive interception or drive-by exploitation without user action is not possible given UI:R in the CVSS vector. No server-side authentication or special configuration of the victim's Chrome instance is required, but the Chrome version must be prior to 152.0.7977.65. Exploitation is limited by the human interaction dependency: automated, mass-scale attacks are impractical without a phishing or malvertising campaign. The impact is limited to information disclosure only - no code execution or data modification is possible through this vulnerability alone.

The CVSS 3.1 base score of 6.5 (Medium) is driven by the High confidentiality impact and network accessibility, but several signals substantially reduce real-world priority. The UI:R metric confirms exploitation is not passive - an attacker must successfully socially engineer the victim, adding a meaningful friction layer. EPSS at 0.17% (7th percentile) indicates the broader security community assesses active exploitation as highly unlikely at time of analysis. There is no CISA KEV listing and no confirmed POC. Chromium's own 'Low' severity rating further aligns with these signals. The CVSS score of 6.5 therefore overstates practical urgency compared to the compound risk indicators. This is a patch-and-monitor issue rather than an emergency response priority. No conflicting signals were identified; all sources consistently point to low exploitation likelihood.

An attacker registers a domain and hosts a specially crafted HTML page designed to trigger improper input handling in Chrome's Network component. The attacker then distributes a link to this page via phishing email, messaging platform, or malicious advertisement, socially engineering Windows users running a vulnerable Chrome version to click through. Upon page load, Chrome's Network subsystem processes the malformed input without adequate validation, causing sensitive information - potentially session tokens, cached credentials, or network response data - to be leaked back to the attacker-controlled server.