Google Chrome EUVD-2026-93582

Exploitation requires the victim to actively open an attacker-crafted HTML page in a vulnerable Google Chrome desktop build prior to 155.0.8059.39, delivered through social engineering (UI:R). No authentication or elevated privileges are needed (PR:N), and no special victim-side configuration is indicated - the flaw lies in the default Editing component. The primary limiting factor is the mandatory user interaction and reliance on convincing the target to visit a malicious page; this is not a background or drive-by exploit against an idle browser, and impact is confined to disclosure of sensitive information (no code execution, modification, or denial of service).

This is a Medium-severity information disclosure flaw (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) in Google Chrome's Editing component. The CVSS vector signals network-reachable, low-complexity, unauthenticated exploitation but critically requires user interaction (UI:R) - the victim must be lured to a crafted HTML page via social engineering, which substantially lowers real-world risk versus a drive-by. Impact is limited to a low confidentiality loss (C:L) with no integrity or availability impact, consistent with CWE-200. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: despite Chrome's enormous footprint, this is a bounded, interaction-gated info-leak rather than a top-priority emergency - patch in normal cycle. Note: EPSS and KEV data are absent from the input (not confirmed negative), so exploitation probability could not be quantified; the reliance on social engineering is the dominant limiting factor.

An attacker crafts a malicious HTML page that abuses the Chrome Editing component and uses social engineering (phishing link, malicious ad, or lookalike site) to convince a victim to open it in a vulnerable Chrome build prior to 155.0.8059.39. Once the page is viewed, flawed handling in Editing discloses sensitive in-memory or cross-context information back to the attacker. No public proof-of-concept is identified in the available data, and successful exploitation hinges on the victim's interaction.