Google Chrome EUVD-2026-100625

Exploitation requires the victim to use Google Chrome on Android at a version prior to 155.0.8059.79 and to load attacker-controlled web content (a crafted HTML page) that exercises the vulnerable ANGLE graphics code path - this is the mandatory user-interaction condition (UI:R). No authentication or special privileges are needed (PR:N), and default configurations are affected since ANGLE is Chrome's standard graphics backend. The primary limiting factors are the required user interaction (victim must visit/render the malicious page), the Android-specific scope, and the need for a working exploit to achieve the stated sandbox escape, which is non-trivial to develop.

This is a genuinely high-priority vulnerability, not a high-CVSS-but-low-risk paper finding. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated heap buffer overflow (CWE-122) in ANGLE, Chrome's graphics abstraction layer, that escapes the renderer sandbox (S:C, 'execute arbitrary code outside the sandbox') with total CIA impact. The only gating factor is user interaction (UI:R): the victim must load a crafted HTML page. CISA's SSVC framework corroborates the severity on impact (Technical Impact: total) but tempers the urgency: Exploitation is rated 'none' (no observed active exploitation) and Automatable is 'no' (UI:R prevents worm-like mass automation). The vulnerability is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. The signals are therefore consistent rather than conflicting: maximal technical impact and trivial attack complexity, but real-world exploitation currently requires luring a user and crafting a working exploit, so it is a patch-now item driven by potential impact and Chrome's ubiquity rather than by confirmed in-the-wild abuse. Note the title says 'on on Android' (a typo) and scopes the flaw to Chrome for Android specifically, while CVSS AV:N is appropriate since delivery is via web content.

An attacker hosts or compromises a web page containing crafted content that triggers the heap buffer overflow in ANGLE when rendered by Chrome for Android. A victim visiting the page (UI:R) causes the overflow, allowing the attacker to potentially execute arbitrary code that breaks out of the renderer sandbox (S:C). No public POC or exploit code is referenced at time of analysis, and exploitation requires low attack complexity but non-trivial exploit development.