Google Chrome EUVD-2026-93607

Exploitation requires the victim to be socially engineered into installing a crafted/malicious Chrome extension - the attack is gated on both user interaction (CVSS UI:R) and the attacker's ability to get that extension onto the target's browser; it is NOT a drive-by against a default Chrome install. The abused component is Chrome DevTools, where a missing authorization check (CWE-862) lets the extension bypass the web origin (same-origin) policy. Limiting factors: affects Chrome versions prior to 155.0.8059.39 (patched installs are not vulnerable), no privileges are needed on the target beyond getting the extension installed (PR:N), and there is no confidentiality or availability impact (C:N/A:N) - only an integrity/origin-isolation bypass (I:H). Chromium's own 'Low' severity rating reflects these constraints.

Signals converge on a genuinely MODERATE, not urgent, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, base 6.5) describes an unauthenticated, network-reachable integrity-only flaw that critically depends on user interaction (UI:R) - namely a victim being socially engineered into installing a crafted Chrome extension. Google/Chromium itself rated the security severity 'Low', which conflicts with the 6.5 (Medium) CVSS and strongly suggests the real-world impact is constrained; the UI:R requirement plus the need to deliver and have a victim install a malicious extension is the key mitigating factor the raw score understates. EPSS reinforces low urgency: 0.22% probability at the 11th percentile indicates exploitation is not expected to be widespread. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active or imminent exploitation. No SSVC decision data was provided. Net: this is a patch-in-normal-cycle browser update, not a drop-everything emergency - the C:N/I:H profile means it bypasses web-origin isolation (an integrity/sandbox boundary issue) rather than directly stealing data or crashing the browser.

An attacker publishes or otherwise convinces a victim to install a specially crafted Chrome extension, then uses the DevTools missing-authorization flaw to have that extension bypass the web origin (same-origin) policy and act across origins it should not reach. No exploit code is publicly identified, and the attack cannot proceed without the victim being tricked into installing the malicious extension (UI:R, social engineering).