Google Chrome Android EUVD-2026-65903

Exploitation requires the target user to actively navigate to a crafted HTML page - social engineering (phishing, malicious link, drive-by) is the delivery mechanism. The CVSS UI:R metric confirms this interaction is mandatory; automated or wormable exploitation is not feasible. The vulnerability is platform-specific to Google Chrome on Android prior to version 152.0.7977.65; Chrome on desktop, iOS, and ChromeOS are not identified as affected. The Payments component must be reachable, which is the default state for any Android Chrome install that supports the Payment Request API. The CVSS PR:N metric confirms no attacker-side authentication is required. Limiting factors include the mandatory user interaction step, the Android-only scope, and the integrity-only impact (no data exfiltration).

The CVSS 4.3 (Medium) score is consistent with the actual risk profile: the attack vector is network-based (AV:N) with no authentication required (PR:N), but exploitation is gated on user interaction (UI:R) via social engineering, and impact is limited exclusively to integrity (I:L) - there is no confidentiality or availability component. The EPSS score of 0.32% at the 24th percentile places this well below the threshold of high-likelihood exploitation, suggesting opportunistic mass exploitation is unlikely. No CISA KEV listing and no confirmed POC further support a measured response posture. The social engineering prerequisite meaningfully constrains the attack surface - automated exploitation is not feasible. Overall this is a real but routine patch-cycle priority rather than an emergency response item.

An attacker crafts a malicious HTML page that abuses Chrome's Payments API on Android to trigger the missing authorization check, then distributes a link to this page via phishing email, SMS lure, or a compromised advertisement network. When the target user opens the link in Chrome for Android, the crafted page executes without requiring any authentication from the attacker side, bypassing system access restrictions and performing unauthorized write-level actions within the browser's permission scope. No public exploit code has been identified at time of analysis.