Google Chrome EUVD-2026-34569

Exploitation requires the victim to be running Google Chrome for Android at a build prior to 149.0.7827.53 on a device that exposes the Web NFC surface, and the user must actively visit (UI:R) an attacker-controlled HTML page. The attack does not require authentication (PR:N) or local access, but it is constrained to Android - desktop Chrome is not exploitable - and to users who can be socially engineered into loading the malicious URL. No special victim-side configuration is called out in the description, suggesting default Chrome-on-Android installations are vulnerable, though whether NFC permission prompts or hardware presence of an NFC radio further gate exploitation is not clarified in the available data.

The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity, unauthenticated attack that requires user interaction (visiting a page) and yields high impact across the CIA triad - consistent with a one-click drive-by privilege escalation. However, the supporting signals temper this: EPSS is only 0.03% (11th percentile), the bug is not in CISA KEV, no public PoC is identified, and Chromium itself rated the internal severity as Medium rather than High or Critical. The realistic priority is moderate: patch promptly on the Android fleet, but this is unlikely to see opportunistic mass exploitation absent a published exploit. Note one apparent inconsistency: the description specifies Chrome on Android, yet the referenced Chrome Releases blog post is the 'Stable Channel Update for Desktop' - defenders should verify the corresponding Android stable channel notes to confirm the exact Android build that ships the fix.

An attacker hosts a malicious HTML page and lures an Android user running a vulnerable Chrome build to visit it via phishing, malvertising, or a compromised site. When the page loads, JavaScript invokes the flawed NFC code path to obtain elevated privileges within the browser context, enabling actions such as cross-origin data access, persistent malicious capabilities, or chained sandbox escape. No public exploit is identified at time of analysis, so this scenario is theoretical based on the CVSS vector and CWE-269 classification.