Google Chrome EUVD-2026-100636

Exploitation requires the victim to be running Google Chrome before version 155.0.8059.79 and to be actively lured, via social engineering, into loading an attacker-crafted HTML page (UI:R) - the leak does not occur against a passive or idle browser. No authentication, special privileges, or non-default configuration is required (PR:N), and the attack is network-delivered via web content (AV:N) at low complexity (AC:L). The principal limiting factor is the mandatory user interaction and successful social-engineering lure; impact is restricted to disclosure of sensitive information from the Passwords feature (C:H) with no integrity or availability effect.

This is a moderate-priority issue that does not rise to emergency status. The CVSS 3.1 score of 6.5 (vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity, unauthenticated flaw whose impact is confined to high confidentiality loss with no integrity or availability effect - consistent with an information leak (CWE-200) in Chrome's Passwords component. The key limiting signal is UI:R combined with the description's explicit reliance on social engineering: exploitation is not automatic and requires luring a victim to attacker-controlled content. Corroborating this lower real-world urgency, the EPSS probability is only 0.17% (6th percentile), indicating low predicted exploitation activity. The CVE is NOT on CISA KEV and no public exploit code is referenced, so there is no evidence of active or opportunistic exploitation - no public exploit identified at time of analysis. Signals are internally consistent (network vector with required user interaction matches a crafted-HTML-page social-engineering leak), so there is no CVSS-versus-description conflict to flag. No SSVC decision record was provided in the input, so automatable/technical-impact determinations cannot be sourced. Net: patch in the normal browser-update cycle; it is a genuine confidentiality flaw but reads as a high-CVSS-component rating tempered by low EPSS, no KEV, and a mandatory user-interaction barrier rather than a widespread-exploitation emergency.

An attacker crafts a malicious HTML page and uses social engineering (phishing link, malicious ad, or deceptive site) to convince a Chrome user to visit it, at which point the page abuses the Passwords component to leak sensitive stored information to the attacker. No authentication is required but the victim must actively interact by opening the attacker's content. No public proof-of-concept or exploit code is identified in the provided data.