Google Chrome EUVD-2026-105508

Exploitation requires the victim to use Google Chrome on Android at a version prior to 156.0.8078.47 and to navigate to attacker-controlled content that causes the browser to render a crafted PDF (reflected by CVSS UI:R). No authentication or prior privileges are needed (PR:N), and default configurations are vulnerable - there is no special feature toggle required. The key LIMITING factors are: mandatory user interaction (the victim must open the malicious page/PDF), platform specificity (Android Chrome only), and the constrained impact - the attacker can only potentially READ memory INSIDE the existing sandbox, not escape it, write memory, or execute code, which substantially narrows realistic harm to information disclosure.

This is a genuinely medium-tier issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N = 6.5) describes a network-reachable, unauthenticated, low-complexity flaw whose only gating factor is required user interaction, with impact limited to confidentiality (information disclosure) - integrity and availability are untouched, and scope is unchanged because the read stays inside the renderer/PDF sandbox. The EPSS score of 0.23% (13th percentile) is low and aligns with the absence of both CISA KEV listing and any public exploit, indicating no evidence of real-world weaponization. Google (Chromium) rated this Medium severity itself. The main thing elevating practical risk is prevalence: Chrome on Android is ubiquitous, so even a medium-severity sandbox memory-read bug is worth patching promptly. Net assessment: a real but non-urgent priority - a high-prevalence, patch-available information-disclosure bug that is NOT a drop-everything emergency given low EPSS, no KEV, and no known POC. No signals conflict here; the limiting factor is simply that the attacker gains only a constrained in-sandbox memory read, not code execution or sandbox escape.

An attacker hosts a crafted HTML page that embeds or triggers a malicious PDF, then lures an Android Chrome user to visit it (via link, ad, or compromised site). When the page renders the PDF, the memory-corruption flaw (CWE-119) is triggered, letting the attacker potentially read adjacent memory contents inside the sandboxed renderer. No public exploit code or active exploitation is known at time of analysis.