Google Chrome EUVD-2026-50910

Exploitation requires the attacker to have local access to the Android device and the ability to deliver a crafted HTML page to the victim. The victim must actively open and interact with that HTML page in Chrome on Android (UI:R), meaning passive or drive-by exploitation is not possible under this attack vector. The vulnerability is platform-specific to Android - Chrome on other operating systems is not identified as affected. The CVSS vector AV:L/PR:N/UI:R confirms no attacker authentication or elevated privileges are required, but the local attack vector rules out purely remote exploitation. The limiting factors for defenders are therefore: physical or logical local access to the device is required, user interaction cannot be bypassed, and only Android Chrome builds prior to 151.0.7922.72 are in scope.

All available signals consistently rate this vulnerability as low priority. The CVSS 3.1 base score is 3.3 (Low), with AV:L requiring local access - not remote network exploitation - which significantly limits the attacker pool. The PR:N metric indicates no attacker privileges are needed, but UI:R means the victim must interact with the attacker-controlled HTML page. EPSS sits at 0.11% (2nd percentile), reflecting extremely low community expectation of exploitation in the wild. CISA SSVC corroborates this: exploitation is confirmed as none, the attack is not automatable, and technical impact is only partial. There is no CISA KEV listing and no public proof-of-concept code identified. The impact is limited to confidentiality (C:L) with no integrity or availability consequence. The only non-trivial risk angle is that Android is a high-prevalence mobile platform, but the local attack vector and required user interaction make mass exploitation implausible. This is a real vulnerability warranting patching in routine cycles, not emergency response.

An attacker with access to an Android device places a specially crafted HTML page on the filesystem or delivers it via a local channel (e.g., USB transfer, locally-hosted link, malicious app writing to shared storage). When the victim opens the page in Chrome on Android, the inappropriate origin validation implementation allows the page's JavaScript to read data from a different origin - such as contents of another tab or local resource - that should be protected by the Same-Origin Policy. No public proof-of-concept exploit has been identified at time of analysis.