Google Chrome Android EUVD-2026-34739

Exploitation requires that the victim is running Google Chrome on Android (prior to 149.0.7827.53) and interacts with a crafted HTML page - user interaction is mandatory (UI:R per CVSS vector). The vulnerability is specific to the CustomTabs implementation on Android; other platforms are not affected. A discrepancy exists between the CVSS AV:N vector and the CVE description's reference to 'a local attacker' - if the 'local' qualifier is accurate, the realistic attack surface may require the attacker to have some proximity or device-level access rather than purely remote delivery, which would further limit exploitability beyond what the CVSS vector alone suggests. No special authentication is required per the PR:N CVSS vector, but the victim must navigate to attacker-controlled content. Exploitation is limited by the Android-only scope, mandatory user interaction, and the requirement to craft a page that specifically triggers the CustomTabs origin validation flaw.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-delivered, low-complexity, no-privilege, user-interaction-required attack with high confidentiality impact and no integrity or availability impact (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). However, there is a notable discrepancy: the CVE description characterizes this as exploitable by 'a local attacker,' which conflicts with the AV:N (Network) vector - this should be verified with the vendor advisory, as the actual attack surface may be narrower than the CVSS vector suggests. EPSS at 0.01% (1st percentile) indicates very low real-world exploitation probability among the broader vulnerability population. No CISA KEV listing and no POC code identified at time of analysis further reduce urgency. Chromium's own 'Low' internal severity rating is consistent with the user-interaction requirement and limited scope. Real-world priority is low for most organizations, but Android-heavy deployments handling sensitive web sessions via CustomTabs should prioritize patching given the confirmed high confidentiality impact.

An attacker hosts a crafted HTML page - potentially delivered via phishing link, malicious advertisement, or QR code - that is opened by a victim in Chrome for Android's CustomTabs context (either directly in Chrome or via a third-party app using the CustomTabs API). The page exploits the origin validation flaw to read confidential data belonging to a different web origin loaded in the same session, such as authentication tokens or session-bound page content. No public exploit code exists at time of analysis, so exploitation currently requires custom development of the crafted HTML trigger.