Google Chrome EUVD-2026-66058

The victim must actively visit a crafted HTML page in Google Chrome on Android (UI:R), meaning the attacker cannot exploit this without some form of social engineering - such as a phishing link, malicious ad, or compromised website. The vulnerability is explicitly scoped to Chrome on Android only; users on Chrome for desktop, Chrome for iOS, or other Chromium-based browsers on non-Android platforms are not affected by this specific flaw. No browser authentication or special configuration is required on the victim's side (PR:N), and no non-default settings need to be enabled. Exploitation is bounded by the Chrome sandbox (S:U), so the attacker cannot directly access OS-level memory or files through this flaw alone - a separate sandbox escape would be required for further lateral movement. The key limiting factors are mandatory user interaction and the Android-only platform scope.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) is driven by the High confidentiality impact, but multiple converging signals indicate this is a routine-priority patch rather than an emergency. EPSS sits at 0.17% (7th percentile), reflecting minimal observed exploitation pressure. CISA KEV does not list this CVE, and no public exploit code exists at time of analysis. Chromium's own security team independently rated it Low severity. The S:U (unchanged scope) metric is critical context: any memory leaked is confined to the Chrome sandbox, meaning the practical ceiling of impact is browser sandbox memory - not OS credentials or file system data. The High C metric in the CVSS vector is technically accurate but contextually overstated compared to real-world exploitation value. This warrants patching on a standard update cycle, not emergency response.

An attacker hosts a malicious webpage containing specially crafted HTML or WebGPU shader content designed to trigger the out-of-bounds read in Tint. When an Android Chrome user visits this page via a phishing link, malvertising redirect, or compromised site, the browser processes the content and Tint reads beyond a buffer boundary, potentially returning sandbox memory contents to the attacker. No public exploit code has been identified at time of analysis, and the required user interaction step limits opportunistic mass exploitation.