Google Chrome Android EUVD-2026-34724

Exploitation requires two specific conditions to be met simultaneously: (1) the attacker must have already compromised the Chrome renderer process on the target Android device - this is a substantial prerequisite that implies a separate, prior renderer exploit in the attack chain; and (2) user interaction is required, specifically a user must load or remain on a crafted HTML page while the renderer is in the compromised state (CVSS UI:R). The vulnerability is limited to Google Chrome on Android and does not affect desktop Chrome builds based on available data. What limits exploitation: the renderer compromise prerequisite is a high bar; EPSS exploitation probability is 0.05%; no KEV listing confirms active exploitation; and the impact is confined to confidentiality (data leak), with no integrity or availability consequence.

The aggregate risk profile is moderate-to-low for most environments despite the CVSS 6.5 score. The most critical limiting factor is the requirement for prior renderer process compromise - a non-trivial precondition that implies this CVE functions as a second-stage exploit in a chain, not a standalone entry point. EPSS at 0.05% (16th percentile) aligns with this assessment, indicating very low observed or predicted exploitation in the wild. No KEV listing and no reported POC further support this. The CVSS vector presents a discrepancy worth noting: PR:N (no privileges required) conflicts with the description's explicit prerequisite of a compromised renderer, which would typically map to a higher privilege or complexity rating. This may reflect Chrome's convention of scoring the specific policy-bypass sub-vulnerability independently of its prerequisite chain. Confidentiality impact is High (C:H) with no integrity or availability impact, meaning the worst case is sensitive cross-origin data exposure, not code execution or service disruption. Organizations running Chrome on Android in high-sensitivity environments (enterprise MDM, banking apps) should treat this as elevated priority within a broader Chrome update cycle.

An attacker who has separately exploited a Chrome renderer vulnerability to gain code execution within the renderer process then serves a crafted HTML page to the victim - requiring only that the user navigate to or remain on the attacker-controlled page. The crafted page triggers the WebAuthentication policy enforcement flaw, causing the compromised renderer to leak cross-origin data (such as authentication tokens or page content from a different origin) back to the attacker. No public POC exists at time of analysis; successful exploitation requires chaining this with a renderer exploit.