Google Chrome EUVD-2026-34756

Exploitation requires the victim to load a crafted HTML page in Google Chrome (or an app embedding WebView) on Android at a version prior to 149.0.7827.53, and the CVSS vector confirms user interaction is required (UI:R) while authentication is not (PR:N). The condition that gates exploitation is rendering attacker-controlled HTML in the vulnerable WebView code path - there is no need for prior code execution, credentials, or non-default settings, but desktop Chrome and non-Android platforms are out of scope per the description, which limits exploitation to the Android WebView surface. Chromium's internal 'Low' severity rating further implies the achievable privilege gain is bounded rather than full sandbox escape, though the exact constraint is not disclosed in public references.

Signals are mixed and tilt toward lower real-world urgency than the headline CVSS suggests. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields 8.8 because exploitation is network-reachable, unauthenticated, and grants high impact, but it does require user interaction and Chromium's own security team rated the underlying issue 'Low' severity, suggesting the privilege gained is constrained. EPSS is 0.04% (13th percentile) and the CVE is not on CISA KEV, with no public exploit identified at time of analysis. Net: prioritize patching through normal Chrome/WebView update cadence rather than emergency response, but note that any WebView issue can become impactful at scale because of the install base. Conflicting signal worth flagging: vendor severity 'Low' versus NVD CVSS 8.8 - the CVSS likely overstates worst-case impact given Chromium's internal triage.

An attacker hosts a crafted HTML page and lures an Android user - via phishing link, malvertising, or a compromised site - to open it in Chrome or in an app that renders content through WebView. When the page is rendered, the inappropriate WebView implementation allows the page's JavaScript or HTML context to perform an action at a higher privilege than the web origin should hold, enabling privilege escalation within the browser or host app context. No public POC has been identified, so any in-the-wild exploitation would require independent weaponization.