Google Chrome EUVD-2026-69744

The victim must be running Google Chrome prior to version 152.0.7977.75 on a desktop platform and must actively navigate to (or be redirected to) a crafted HTML page under attacker control. User interaction is required (UI:R); fully automated network-side exploitation without user participation is not viable under this vulnerability class. No special authentication, browser configuration, or non-default feature enablement is identified as a prerequisite - any standard Chrome installation on a supported desktop OS is within scope. Exploitation is constrained by the need to deliver the malicious page to the victim (e.g., via phishing or drive-by via a compromised site), which limits scale compared to UI:N vulnerabilities.

The CVSS 6.5 Medium score accurately reflects a user-interaction-dependent, integrity-only vulnerability: AV:N and PR:N indicate no attacker-side prerequisites beyond hosting a webpage, but UI:R means mass automated exploitation is not feasible without a delivery mechanism that compels user navigation. The I:H metric is meaningful here - bypassing SiteSettings could silently grant a page access to sensitive hardware APIs without the expected permission dialog, representing a real privacy and integrity risk. The EPSS score of 0.17% (6th percentile) aligns with the absence of KEV listing and any known public POC, suggesting the technique has not been operationalized. Even a mid-sized municipal IT team in zabrze should treat this as a standard patch-cycle item rather than an emergency response, given the mandatory user-interaction requirement substantially reduces the realistic threat level compared to a true zero-interaction browser bug. The 'Authentication Bypass' tag in source metadata is a loose fit for what is properly an authorization bypass (CWE-863).

An attacker hosts a crafted HTML page engineered to trigger the SiteSettings authorization flaw and delivers a link to the target via phishing, malicious advertising, or a compromised website. When a victim running a vulnerable Chrome version visits the page, the browser skips the expected permission authorization check for a sensitive API (such as geolocation), silently granting the page access without displaying a consent prompt. No public exploit code has been identified at time of analysis, so exploitation currently requires independent development of the bypass technique.