Google Chrome Android EUVD-2026-34736

Two concrete prerequisites must both be satisfied: (1) the attacker must have already achieved code execution within the Chrome renderer process on the victim device - this is an explicit prerequisite stated in the CVE description, meaning this vulnerability cannot be triggered standalone; and (2) user interaction is required (CVSS UI:R), meaning the victim must visit or interact with attacker-controlled content. The vulnerability is scoped exclusively to Chrome on Android - Chrome on desktop platforms is not affected per the description. Exploitation is limited by the renderer compromise requirement, which itself demands a separate, successful exploit chain. The CVSS PR:N rating applies to attacker system privileges (no OS-level authentication needed), not to the renderer precondition.

CVSS scores this at 6.5 (Medium) with AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, reflecting high integrity impact reachable over the network with no attacker privilege. However, this vector conflicts with the description, which states the attacker must have already compromised the renderer process - a substantial precondition that CVSS PR:N does not capture and that significantly raises the real-world attack complexity beyond what AC:L implies. Defenders should treat this as requiring a multi-step exploit chain, not a standalone remote vulnerability. EPSS at 0.02% (4th percentile) corroborates low exploitation likelihood. Absence from CISA KEV and no identified POC further reduce urgency. Google's own severity classification is Low. Real-world priority is correspondingly low unless operating in a threat model where renderer exploits are a realistic first-stage risk (e.g., high-value mobile targets). CVSS/description discrepancy on privilege requirements should be verified with Google's advisory.

An attacker first delivers a crafted HTML page to a victim Chrome for Android user that exploits a separate renderer-level vulnerability to gain code execution within the sandboxed renderer process. With renderer control established and the victim interacting with the page (satisfying UI:R), the attacker then triggers Chrome's Page Info component via the inappropriate implementation flaw, bypassing navigation restrictions to load or navigate to URLs that would otherwise be blocked by Chrome's security policy. No public proof-of-concept for this specific CVE has been identified at time of analysis.