Google Chrome EUVD-2026-69738

Exploitation requires two concrete prerequisites drawn from the description: (1) successful social engineering of the victim - the user must be induced to take an action, so this is effectively user-interaction-dependent, not silent; and (2) a specific co-installed application on the host through which the DataTransfer data is channeled to bypass system access restrictions. Limiting factors: absent that co-installed app and a cooperating user action, the bypass does not trigger; this materially constrains exploitation despite the network attack vector, and directly contradicts the input CVSS UI:N/AC:L rating.

The signals conflict. The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is internally inconsistent with the description: the text explicitly requires an attacker 'leveraging social engineering' and 'a co-installed app', which contradicts UI:N and AC:L - a true 9.8 would need no user interaction and no special preconditions. Chromium's own rating is 'High', not Critical, and Chrome High-severity issues typically score nearer 8.x with UI:R. Corroborating the lower real-world risk, EPSS is only 0.16% (5th percentile), there is no CISA KEV listing (no confirmed active exploitation) and no public exploit identified. This is best treated as a genuine browser-hardening fix worth patching promptly, but NOT a wormable pre-auth network RCE despite the headline 9.8 - verify the vector with Google before treating it as no-interaction remote-critical.

An attacker lures a user to a malicious web page and, through social-engineering cues, gets them to perform a clipboard or drag-and-drop action that feeds attacker-controlled data into Chrome's DataTransfer. The malformed data is passed to a co-installed application in a way that bypasses system access restrictions, granting the attacker access beyond Chrome's normal sandbox. No public exploit code is known at time of analysis.