Google Chrome Android CVE-2026-76039

Exploitation requires the victim to be running Google Chrome on an Android device with a version prior to 151.0.7922.169. The attacker must successfully socially engineer the user into visiting a crafted HTML page, as confirmed by both the description and the CVSS UI:R (User Interaction Required) metric. No authentication is required on the attacker's side (PR:N), and no special non-default browser configuration is needed. Exploitation is strictly limited to Android - the vulnerability does not affect Chrome on Windows, macOS, Linux, iOS, or ChromeOS per available data. The mandatory social engineering step (e.g., phishing link, malicious ad) is the primary limiting factor: automated or zero-click exploitation is not indicated by any available signal.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a medium-severity information disclosure. Attack complexity is low and no privileges are required, but user interaction is mandatory - the victim must be socially engineered into visiting a crafted page, which meaningfully reduces the realistic threat surface compared to fully-automated exploitation. The Confidentiality impact is rated High, indicating the potential to read sensitive data, but Integrity and Availability are unaffected, limiting the blast radius. No EPSS score was provided in the input, so exploitation probability cannot be quantitatively assessed. The vulnerability is not listed in the CISA KEV catalog and no public POC has been identified, placing this in a lower operational priority tier despite the High CVSS confidentiality impact. The Android-only scope further narrows the affected population relative to the full Chrome user base. Overall, this is a genuine but targeted-risk vulnerability: prioritize patching in environments handling sensitive data on Android Chrome (enterprise MDM, mobile banking, government), but it does not represent an imminent mass-exploitation threat.

An attacker registers a domain and serves a crafted HTML page designed to trigger Chrome's incorrect reference resolution on Android. The attacker then sends the link to a target via phishing email, SMS, or social media, convincing them to open it in Chrome on their Android device. Once the page loads, the incorrect resolution silently exposes sensitive information - such as cross-origin data or locally accessible content - back to the attacker-controlled server.