Google Chrome EUVD-2026-105608

Exploitation requires the victim to render attacker-controlled HTML inside Chrome's CustomTabs component on Android (UI:R) - i.e., the user must open or be redirected to a crafted page, typically via an in-app CustomTab browser view. No authentication is required (PR:N) and no special non-default configuration is needed, but the bug is platform-specific: it affects Chrome on Android only, not desktop, and only versions prior to 156.0.8078.47. The primary limiting factors are the mandatory user interaction and the sandbox boundary - the leak is confined to memory inside the renderer sandbox and discloses no integrity or availability impact, so on its own it cannot read data outside the sandboxed process.

This is a medium-severity information-disclosure flaw whose signals are internally consistent and point to a low operational priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated bug that nonetheless requires user interaction (UI:R) - the victim must open or be lured to a crafted HTML page - and yields only confidentiality impact with no scope change. Critically, Google's own Chromium rating is 'Medium,' and the leak is explicitly bounded to memory inside the renderer sandbox, so it does not by itself give an attacker code execution or data outside the sandboxed process. The exploitation signals reinforce low urgency: EPSS is just 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. No signals conflict - a medium CVSS, very low EPSS, absent KEV, and vendor 'Medium' severity all agree. The practical risk is that an OOB read like this is typically most valuable as one link in a longer exploit chain (e.g., leaking pointers to defeat ASLR ahead of a separate memory-corruption bug) rather than as a standalone threat. For most defenders this is a routine 'patch on the normal Chrome auto-update cycle' item, not an emergency.

A remote attacker hosts or injects a crafted HTML page and lures an Android user into opening it within a Chrome CustomTab (for example, an in-app browser view launched from a link in a messaging or social app). Rendering the page triggers the out-of-bounds read in the CustomTabs code path, letting the attacker read adjacent memory contents inside the renderer sandbox. No public exploit code was identified at time of analysis; realistically the leaked data would be used to support a follow-on exploit rather than as a final objective.