Google Chrome EUVD-2026-66039

Exploitation requires the victim to be on an Android device running Google Chrome prior to version 152.0.7977.65 and to open a crafted HTML page within a CustomTabs-enabled application - this is the key limiting condition, as the spoofing only manifests in the CustomTabs context, not in standalone Chrome browser tabs. The CVSS UI:R metric confirms user interaction is mandatory; the victim must actively navigate to or open the malicious page. The attack is constrained to Android only - desktop Chrome, iOS Chrome, and non-CustomTabs browser sessions are not exploitable paths. No authentication or special privileges are required from the attacker (PR:N), and no non-default configuration is needed on the victim's device. The primary limiting factor reducing realistic risk is the requirement that the victim must be using a CustomTabs-presenting app at the time of the attack, narrowing the exploitable surface compared to a direct browser flaw.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects a low-complexity, network-reachable flaw requiring only user interaction, with a narrow impact limited to integrity. EPSS at 0.17% (7th percentile) suggests minimal observed or anticipated exploitation activity, consistent with the absence of a CISA KEV listing and no confirmed public proof-of-concept code. Chromium's internal severity rating of 'Low' aligns with these signals. The Scope:Unchanged metric confirms the vulnerability is contained within the browser session and does not pivot to other components. The practical risk is that this flaw can serve as a reliable phishing facilitator - defenders should weigh not just the raw CVSS score but the downstream social engineering potential, particularly in enterprise Android deployments where CustomTabs-enabled apps access sensitive services. Overall: low autonomous exploitation risk, moderate phishing-facilitation risk in targeted campaigns.

An attacker hosts a crafted HTML page that exploits the CustomTabs rendering flaw to display a trusted domain (e.g., a bank or enterprise SSO portal) in the address bar while serving attacker-controlled content. A victim receives a link via email, SMS, or an in-app notification; upon opening it in an Android app using CustomTabs, the address bar shows a spoofed legitimate URL, inducing the victim to submit credentials or approve actions. No proof-of-concept code has been publicly confirmed at time of analysis.