Google Chrome EUVD-2026-66088

Exploitation requires a victim to actively navigate to an attacker-controlled or compromised HTML page using a vulnerable Chrome version (prior to 152.0.7977.65) - the CVSS UI:R metric confirms that passive or drive-by exploitation without any user interaction is not possible. The attacker requires no authentication (PR:N) and no special network position; any reachable web server suffices as a delivery vehicle. Exploitation is scoped strictly to the Chrome renderer sandbox (S:U), meaning the flaw does not provide a sandbox escape on its own; an attacker seeking OS-level impact would need to chain this with a separate sandbox-escape vulnerability. The flaw is limited to the Skia rendering path triggered by processing the crafted page content, and is not exploitable without the victim loading the page.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N yields a base score of 6.5, reflecting unauthenticated network delivery with low complexity but mandatory victim interaction, high confidentiality impact, and no integrity or availability consequences. The S:U (Unchanged scope) metric is critical context: exploitation is bounded by the Chrome renderer sandbox, limiting the blast radius to data already present in that process. The EPSS score of 0.19% at the 9th percentile is very low and strongly suggests no broad exploitation activity at time of analysis. Chromium's own internal severity rating of 'Low' further signals limited practical impact in isolation. No POC code has been identified and the vulnerability does not appear in CISA KEV. The combination of sandbox containment, required user interaction, low EPSS, and vendor-assessed low severity positions this as a moderate-priority patch rather than an emergency response - it is most concerning as a potential information-disclosure building block in a multi-stage browser exploit chain, not as a standalone critical threat.

An attacker hosts a crafted HTML page containing content designed to trigger the uninitialized Skia resource path during rendering. When a victim navigates to this page with a vulnerable Chrome version, stale memory contents from the renderer process are read and may be observable by the attacker, potentially disclosing sensitive in-process data such as previously rendered page content or credentials. No public POC has been identified; this scenario is inferred from the CVSS vector (AV:N/UI:R) and CWE-908 classification.