Google Chrome EUVD-2026-93600

Exploitation requires the victim to be running a Google Chrome version prior to 155.0.8059.39 and, via social engineering, to actively visit an attacker-controlled crafted HTML page that triggers the Glic component (Chrome's integrated AI/Gemini assistant feature); the incomplete-cleanup flaw (CWE-459) then leaks data from another origin. Key limiting factors: mandatory user interaction (UI:R) - the attack cannot fire without the victim navigating to the malicious page - and the impact being confined to low-sensitivity cross-origin read access (C:L, no integrity or availability impact). The bug is not automatable per SSVC, so drive-by mass exploitation is impractical, and it is already remediated in the stable channel.

This is a low-priority, low-real-risk issue despite its network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) shows that although the attack is remote and unauthenticated with low complexity, it requires user interaction and yields only low confidentiality impact with no integrity or availability impact - consistent with Google's own 'Low' Chromium severity rating. All corroborating signals point the same direction rather than conflicting: SSVC assesses Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. There is no CISA KEV listing and no public POC identified in the provided data, and no EPSS score was supplied. The signals are therefore mutually consistent - a genuine but minor information-disclosure bug requiring social engineering, not a priority for emergency patching. Because Automatable is 'no' and user interaction is mandatory, mass/automated exploitation is unlikely; any realistic abuse would be targeted. No key data is strongly conflicting, though the absence of an EPSS score means exploitation-probability modeling could not be independently cross-referenced.

An attacker uses social engineering to lure a Chrome user into visiting a crafted HTML page, which abuses incomplete cleanup in the Glic component to read data belonging to another origin. No public exploit code was identified in the available data, and successful exploitation depends on the victim actively interacting with the attacker-controlled page.