Google Chrome EUVD-2026-93589

Exploitation requires the attacker to perform social engineering: the victim must be lured to visit an attacker-controlled crafted HTML page and then interact with the spoofed Payments interface (UI:R). The flaw resides specifically in Chrome's Payments UI component, so the attack is only meaningful when the user is engaging with payment-related browser functionality. No authentication is required of the attacker (PR:N) and the attack is network-delivered against a default Chrome installation prior to version 155.0.8059.39, but the mandatory per-victim user interaction and the reliance on convincing social engineering (rather than any automatable trigger, per SSVC Automatable=no) are the primary factors limiting real-world exploitability.

This is a low-priority issue despite its 5.4 (medium) CVSS base score, and multiple independent signals agree on that assessment. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) shows a network-reachable, low-complexity, unauthenticated flaw, but it critically requires user interaction (UI:R) and yields only partial confidentiality and availability impact with no integrity impact. Chromium itself rated this 'Low' severity. The CISA SSVC framework reinforces low priority: Exploitation=none (no observed or public exploitation), Automatable=no (it depends on per-victim social engineering and cannot be mass-automated), and Technical Impact=partial. No EPSS score was provided in the input, and there is no CISA KEV listing and no indication of public exploit code. The one mild internal tension is that the CVSS vector assigns A:L (availability impact), which is hard to justify for a pure UI-misrepresentation/spoofing bug (CWE-451) - spoofing typically affects what the user perceives rather than service availability; this does not change the overall low-risk conclusion. Bottom line: a real but minor browser spoofing weakness whose exploitation hinges entirely on tricking a specific user, not a widespread or automatable threat.

An attacker lures a victim to a crafted HTML page that manipulates the rendering of Chrome's Payments UI, causing legitimate-looking payment interface elements to be misrepresented or overlaid. The victim, believing they are interacting with a trusted Chrome payment prompt, is deceived into trusting spoofed content and potentially disclosing or confirming sensitive payment-related details. No public exploit code was identified, and success depends on the victim visiting the page and interacting with the spoofed elements (UI:R).