Google Chrome EUVD-2026-105559

Exploitation requires the victim to open Chrome on Android (version prior to 156.0.8078.47) and navigate to attacker-controlled crafted HTML content that exercises the 'Offline' feature's parsing path; this user-interaction requirement (CVSS UI:R) is the primary limiting factor. No authentication or elevated privileges are needed (PR:N). The impact is strictly a memory read bounded to inside the renderer sandbox, yielding information disclosure only (C:H, I:N, A:N) and not, by itself, code execution or sandbox escape. Limiting factors: the target must be an un-updated Android Chrome build and the user must load the malicious page.

This is a genuine but non-urgent patch-management item rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5 Medium) indicates a remote, low-complexity, unauthenticated attack that nonetheless requires user interaction (the victim must load a crafted HTML page), with confidentiality-only impact (C:H, I:N, A:N) - consistent with a CWE-125 out-of-bounds read that leaks memory but does not corrupt it. Google's own Chromium rating is Medium, aligning with the Medium CVSS. Exploitation-probability signals reinforce low urgency: EPSS is 0.23% (13th percentile), it is NOT listed in CISA KEV, and no public exploit code is referenced - so there is no public exploit identified at time of analysis. No SSVC decision data was provided in the input. The signals are mutually consistent (low EPSS, no KEV, Medium severity, user-interaction requirement), so there is no conflict to flag; the key caveat is that the memory read is explicitly bounded to 'inside the sandbox,' limiting it to information disclosure within Chrome's renderer rather than full system compromise. Net: a real priority for routine browser updating given Chrome's enormous footprint, but not a drop-everything issue absent any exploitation evidence.

An attacker hosts a malicious or compromised web page and lures an Android user running an outdated Chrome (prior to 156.0.8078.47) to visit it; the page's crafted content triggers the out-of-bounds read in the Offline component, allowing the attacker to potentially read adjacent memory within the renderer sandbox and exfiltrate it (e.g., to defeat ASLR or leak sensitive in-process data). No public exploit code is identified at time of analysis, and the attack requires user interaction (navigating to the page) with low attack complexity.