Google Chrome EUVD-2026-93578

Exploitation requires the victim to use Google Chrome prior to version 155.0.8059.39 and to actively navigate to an attacker-controlled or compromised web page that exercises the WebAudio API (the required user interaction, UI:R). No authentication or prior privileges are needed (PR:N), and default Chrome configurations are affected since WebAudio is a standard, enabled-by-default web platform feature. Limiting factors: the attack cannot succeed without that user navigation, it is not automatable (SSVC Automatable: no), and the impact is bounded to reading memory within the renderer sandbox - it is not a sandbox escape and has no integrity or availability impact. Patching to 155.0.8059.39 or later fully remediates.

This is a genuinely moderate-priority issue rather than an urgent one, and the signals are mutually consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a remote, low-complexity, unauthenticated attack that requires user interaction (victim must open a crafted page) and yields high confidentiality impact with no integrity or availability impact - consistent with the description of reading memory inside the renderer sandbox via WebAudio. The EPSS score is low (0.19%, 8th percentile), and the vulnerability is NOT on the CISA KEV list, so there is no evidence of active exploitation. SSVC reinforces a measured posture: Exploitation is only 'poc' (proof-of-concept, not active), Automatable is 'no' (user interaction defeats mass/automated exploitation), and Technical Impact is 'partial'. All signals align - a real but contained info-leak bug, important because Chrome is ubiquitous and info leaks are frequently chained into fuller exploit chains, but not a standalone high-urgency, worm-able threat. Note: the leak is bounded to memory inside the sandbox (per the description), not a sandbox escape, which further limits standalone severity; the C:H rating reflects that sensitive in-process data (e.g., cross-origin memory) could be exposed.

An attacker hosts or compromises a web page containing malicious JavaScript that exercises the WebAudio API in a way that triggers use of an uninitialized resource. When a victim visits the page, the attacker reads leaked memory contents from inside the renderer sandbox, potentially exposing sensitive in-process data. A proof-of-concept is indicated by the SSVC 'poc' status, but no weaponized or actively-exploited code is confirmed.