Google Chrome EUVD-2026-34708

Exploitation requires several concurrent conditions: the victim must be using Google Chrome on Android (not desktop or iOS), the vulnerable page must be rendered inside a Chrome CustomTabs session (not a standard browser tab), the victim must actively navigate to or interact with the attacker-controlled HTML page (UI:R), and the attack complexity is rated High (AC:H), indicating additional preconditions such as race conditions, specific application state, or particular CustomTabs configuration may be necessary. The CVSS PR:N confirms no authentication to the attacker's infrastructure is required, but the attacker has no control over whether the victim's app uses CustomTabs. Exploitation is further limited to Android devices running affected Chrome versions below 149.0.7827.53. The practical attack surface is restricted to apps that use CustomTabs to render cross-origin content containing sensitive data worth stealing.

The overall risk is low and consistent across all available signals. CVSS 3.1 reflects Network attack vector (AV:N) but is heavily tempered by High Attack Complexity (AC:H) and required User Interaction (UI:R), meaning exploitation is not trivially automatable and requires the victim to navigate to a crafted page under specific conditions. The scope is Unchanged (S:U) and confidentiality impact is only Low (C:L), with no integrity or availability impact. EPSS at 0.03% (11th percentile) confirms that the security community does not currently anticipate widespread exploitation. There is no CISA KEV listing and no reported POC. Chromium's own internal severity rating of 'Low' aligns with NVD scoring. No conflicting signals were identified - all sources consistently characterize this as a low-priority, low-likelihood exploitation scenario. The primary real-world concern is targeted data exfiltration from Android apps that use CustomTabs to render sensitive cross-origin content.

An attacker hosts a crafted HTML page designed to exploit the CustomTabs policy enforcement gap and socially engineers an Android user into opening the link within an app that uses Chrome CustomTabs (such as a social media or email client). When the page loads, it leverages the cross-origin isolation failure to read or infer data from another origin accessible within the CustomTabs session, potentially exfiltrating authentication tokens, page content, or user-specific identifiers. No public exploit code has been identified, and the high attack complexity suggests precise timing or environmental conditions may be required to successfully trigger the leak.