Google Chrome EUVD-2026-93590

Exploitation requires the Picture-in-Picture feature path in Chrome for Android (versions prior to 155.0.8059.39) and that the victim actively navigates to an attacker-controlled crafted HTML page (UI:R). The attack is limited to UI deception: it cannot execute code, read data, or persist, and its success further depends on the user being fooled by the spoofed address bar and then taking an action such as entering credentials. It affects Android Chrome specifically, not desktop builds, and is remediated simply by updating to 155.0.8059.39 or later.

This is a low-severity, low-priority issue despite a moderate 5.4 CVSS score. The provided CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) indicates a network-reachable, low-complexity, unauthenticated flaw requiring user interaction, which aligns with the description: a victim must visit a crafted HTML page. Google/Chromium itself rated the security severity as Low, and CWE-451 (UI misrepresentation) confirms this is an address-bar spoofing/deception issue rather than code execution or data theft. No EPSS score, KEV listing, or POC was provided; there is no public exploit identified at time of analysis, so there is no evidence of active or imminent widespread exploitation. Note a signal conflict: the input CVSS impact metrics (C:L/A:L, I:N) fit awkwardly with a pure address-bar spoof, which is fundamentally an integrity-of-display/deception problem rather than a confidentiality or availability loss - this likely reflects Chrome's conservative scoring rather than genuine data disclosure or DoS. The realistic risk is phishing enablement, not direct compromise, so this ranks well below critical browser RCE or sandbox-escape bugs for patch prioritization.

An attacker hosts a malicious web page and lures an Android Chrome user to it (e.g., via a phishing link or malicious ad). Using the Picture-in-Picture feature, the page manipulates the displayed URL so the address bar shows a trusted domain while malicious content is rendered, tricking the victim into trusting or entering credentials on an attacker-controlled page. No public POC was provided, and the attack depends entirely on the user visiting the page and acting on the spoofed indicator.