Google Chrome EUVD-2026-34751

Exploitation requires the attacker to have local access to the Android device with at least low-privilege (standard user account) access, as confirmed by CVSS PR:L. The victim must actively open or interact with a malicious file that is processed by Chrome's WebView component (UI:R). The vulnerability is specific to Chrome on Android - not Chrome on desktop platforms. The attack vector is local (AV:L), ruling out remote unauthenticated exploitation entirely. Limiting factors include: physical or local logical access to the device is required; user interaction with the malicious file is mandatory; the impact is limited to a denial of service (crash) with no data exfiltration or code execution potential based on the C:N/I:N CVSS impact scores; and the attack scope is unchanged (S:U), meaning the overflow cannot pivot to affect other applications or the OS.

The overall real-world risk is low. CVSS 5.0 reflects a purely local attack vector (AV:L), requiring low privileges (PR:L) and user interaction (UI:R), with impact limited to availability (A:H) and no confidentiality or integrity impact. This is not a remotely exploitable vulnerability. EPSS of 0.01% at the 1st percentile independently corroborates negligible exploitation likelihood in the wild. The CVE is not listed in the CISA KEV catalog, and no public exploit code has been identified. Chromium's own security team rated this Low severity. The primary real-world impact would be application or tab crashes on affected Android devices, not persistent compromise. The only notable signal elevating concern is the A:H availability rating, but in the context of a browser WebView, this means a crash rather than a system-wide outage. The CWE mismatch (CWE-472 assigned vs. integer overflow described) introduces minor analytical uncertainty about the exact root cause class - verify against the Chromium issue tracker.

A local attacker with a standard user account on an Android device places or social-engineers the victim into opening a specially crafted file - such as a malformed HTML, image, or document - that is rendered through a Chrome WebView surface. When the victim opens the file, the integer overflow in WebView is triggered, causing Chrome or the embedding application to crash. No public proof-of-concept exploit code has been identified at time of analysis.