Google Chrome EUVD-2026-89389

Requires the victim to load a crafted HTML page in Chrome prior to 154.0.8037.92 (UI:R), which specifically exercises the vulnerable Skia graphics rendering path. No authentication and no special browser configuration are needed (PR:N, default Chrome build affected). The primary limiting factor is the mandatory user interaction - the attacker must convince the target to visit or render attacker-controlled content - and the impact is bounded to a partial cross-origin information leak with no code execution, integrity, or availability effect.

This is a genuinely lower-severity Chrome issue and the multiple signals agree, which is unusual for this batch of Chrome CVEs. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (loading a crafted page) and yields only LOW confidentiality impact with NO integrity or availability impact - consistent with an uninitialized-memory cross-origin read (CWE-908) rather than a memory-corruption RCE. Note that Google labels the underlying Chromium severity as 'High', but that reflects internal bug-bounty triage of the Skia component, not real-world exploitability; the CVSS base of 4.3 is the better decision anchor here. All exploitation signals point low: SSVC decision is Exploitation=none, Automatable=no, Technical Impact=partial; there is no CISA KEV listing and no public exploit code identified at time of analysis. EPSS is not provided in the input. These signals are mutually consistent - no conflict between CVSS, SSVC, and exploitation status. A patch is confirmed available from the vendor. Bottom line: real but modest priority - patch via normal Chrome auto-update cadence rather than emergency response; the low impact ceiling (cross-origin data leak, not code execution) and lack of any exploitation evidence keep this well below the RCE-class Skia/V8 bugs.

An attacker hosts or injects a crafted HTML page that exercises the vulnerable Skia rendering path; when a victim browses to it, uninitialized memory is read and leaked across origin boundaries, exposing fragments of data the page should not be able to see (e.g. pixels or bytes from another origin). No public proof-of-concept is identified, and success depends on the victim actively loading the malicious page (UI:R).