Google Chrome EUVD-2026-50659

Exploitation requires the victim to be running Google Chrome on an Android device with Chrome version prior to 151.0.7922.72, as the Web NFC API (NDEFReader) is exclusive to Chrome on Android and is not present in desktop Chrome builds. The victim must actively navigate to an attacker-controlled HTML page (UI:R per CVSS vector). The Android device must have NFC hardware present and enabled at the OS level, and the Web NFC API must not be blocked by an enterprise feature policy. No attacker-side authentication or privilege is required (PR:N). Exploitation is not automatable per SSVC assessment, meaning it cannot be carried out at scale without individual user interaction for each target. The Android-only NFC API scope, user-visit prerequisite, and requirement for NFC-accessible cross-origin data to exist in the victim context meaningfully constrain realistic targeting compared to the raw CVSS score.

The CVSS 3.1 base score of 4.3 (Medium) reflects limited impact (C:L, I:N, A:N) with no privilege requirement and a network attack vector, but mandatory user interaction (UI:R) constrains the attack surface. EPSS at 0.17% (7th percentile) is very low and strongly indicates no observed attacker interest in this vulnerability. CISA SSVC confirms exploitation: none and automatable: no, ruling out mass or opportunistic campaigns. There is no CISA KEV listing and no public POC. The Chromium security team internally rated this severity as Low. Taken together, these signals characterize this as low real-world priority: the Android-only NFC API scope, user-interaction requirement, and absence of any exploitation activity make this suitable for routine patch cycle handling rather than emergency response. The information disclosure impact is bounded to cross-origin NFC-accessible data rather than broad credential or memory exposure.

An attacker registers a domain and hosts a crafted HTML page that invokes the NDEFReader Web NFC API in a way that bypasses Chrome's cross-origin policy enforcement. When an Android user running a vulnerable Chrome version visits this page - for example via a phishing link or malicious advertisement - the page can silently read cross-origin NFC-associated data, potentially exposing session tokens or other sensitive content tied to a different web origin. No public exploit code for this specific vulnerability has been identified at time of analysis.