Chrome for iOS EUVD-2026-93579

Exploitation requires the attacker to have ALREADY compromised Chrome's renderer process on iOS (a prior, separate exploit is a hard prerequisite), and then to serve a crafted HTML page to the victim, implying required user interaction (UI:R) to load the page. The specific affected component is the Safe Browsing feature in Chrome for iOS prior to 155.0.8059.39; the flaw is an observable discrepancy (CWE-203 side channel) rather than a direct read primitive. Limiting factors that reduce realistic risk: the renderer-compromise precondition, the need for user interaction, the restriction to the iOS platform, and high attack complexity (AC:H). There is no indication of active exploitation (SSVC Exploitation=none, not in CISA KEV) and no public exploit identified at time of analysis.

This is a medium-severity information-disclosure issue (CVSS 5.3) whose real-world risk is tempered by a significant precondition that the raw CVSS vector understates. The vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) marks the attack as network-reachable and unauthenticated, but the description explicitly states the attacker must have ALREADY compromised the renderer process - a substantial prerequisite that Chrome's sandbox threat model treats as a separate chaining step rather than a 'privilege,' which is why PR is scored N while AC is H. These two signals should be read together: this is a post-renderer-exploit information leak, not a standalone remote drive-by. Supporting signals all point to low urgency: SSVC reports Exploitation=none, Automatable=no, Technical Impact=partial, and there is no CISA KEV listing and no public exploit. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The C:H rating for a CWE-203 observable-discrepancy side channel also appears aggressive relative to the described impact (leaking 'sensitive information' via a timing/behavioral discrepancy typically yields limited data); this disagreement is noted rather than treated as confirmed. Net assessment: a genuine but low-priority defense-in-depth fix, meaningful mainly as the second link in an exploit chain, not an independent high-risk threat.

An attacker who has already achieved code execution in Chrome's renderer process (via a separate prior vulnerability) lures or redirects the victim to a crafted HTML page. By observing a discrepancy in the Safe Browsing component's behavior, the compromised renderer infers sensitive information it should not be able to read. No public exploit code was identified for this specific issue, and the high attack complexity reflects the need for a pre-existing renderer compromise plus user interaction.