Google Chrome Android EUVD-2026-66021

Exploitation requires that the victim uses Google Chrome on an Android device with a version prior to 152.0.7977.65, and that the victim actively visits (or is redirected to) a crafted HTML page - user interaction is mandatory (CVSS UI:R). The vulnerability is platform-specific: only Android Chrome is affected, not Chrome on Windows, macOS, iOS, or Linux. No special configuration of the browser or device is required beyond running a vulnerable Chrome version on Android. Exploitation is limited by the need for user engagement with the malicious content and by the Android Intents permission model, which may constrain what data can actually be surfaced depending on the victim's app ecosystem and Android version.

The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a meaningful but constrained risk profile: network-reachable, no authentication required, but requiring active user interaction to visit a crafted page, with impact limited to confidentiality only. Chromium's own classification of 'Low' severity is notably divergent from the NVD's 6.5 and C:H rating - this discrepancy likely reflects Chromium's assessment of the practical difficulty in extracting actionable data or the limited scope of what can be leaked. EPSS at 0.17% (7th percentile) confirms very low observed exploitation probability, and the absence of a CISA KEV listing means active exploitation is not confirmed. No public POC has been identified. In practical terms, this is a low-urgency patch for most organizations - the attack requires social engineering a specific Android Chrome user to a malicious page, and the information disclosure scope is not yet fully characterized. Patch promptly as part of routine browser update cycles rather than emergency response.

An attacker creates a malicious HTML page that triggers an Android Intent interaction designed to expose sensitive information from the Chrome browser context. The attacker distributes a link to this page via phishing, SMS, or a compromised advertisement, enticing an Android Chrome user to visit it. Upon page load, the Intent handling flaw causes the browser to leak data - potentially URLs, session identifiers, or other in-scope information - to the attacker-controlled origin without the victim's awareness.