Google Chrome EUVD-2026-100653

Exploitation requires the victim to use Google Chrome prior to version 155.0.8059.79 and to actively visit an attacker-crafted HTML page (UI:R), which the attacker must lure the user into loading. The flaw lies in Chrome's Media component and leverages an observable discrepancy (CWE-203) side channel to leak cross-origin data. Limiting factors: HIGH attack complexity (AC:H) means the attacker must satisfy specific timing/state conditions outside their control for the discrepancy to be observable; impact is confined to LOW-volume confidentiality disclosure (C:L) with no integrity or availability effect; and no privileges are needed (PR:N) but the required user interaction and complexity substantially reduce realistic exploitability.

Multiple signals converge on LOW real-world priority despite the Chromium 'High' severity label. The CVSS 3.1 base score is only 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N): although network-reachable and unauthenticated, exploitation carries HIGH attack complexity (AC:H, consistent with a CWE-203 observable-discrepancy/side-channel that requires specific timing or state conditions), requires user interaction (UI:R - the victim must visit a crafted page), and yields only LOW confidentiality impact with no integrity or availability impact. EPSS reinforces this: 0.17% probability at the 6th percentile indicates very low likelihood of observed exploitation. The CVE is NOT in CISA KEV and no public exploit code is identified in the provided data, so there is no evidence of active exploitation. Note a tension worth flagging: the vendor's internal 'High' severity rating (Chromium's own scale) is markedly higher than the CVSS 3.1 base of 3.1 - this reflects Chromium's tendency to rate cross-origin data leaks highly on principle, not a signal of broad exploitability. No SSVC decision data was provided. Bottom line: a genuine but low-urgency browser flaw; patch via normal Chrome update cadence rather than emergency response.

An attacker hosts a malicious web page and lures a Chrome user (prior to 155.0.8059.79) into visiting it. The page uses a media-component side channel (observable discrepancy, CWE-203) to infer and leak small amounts of cross-origin data that the same-origin policy should protect. No public proof-of-concept is identified, and the high attack complexity means reliable exploitation is non-trivial.