Google Chrome EUVD-2026-93626

Requires the victim to actively load an attacker-crafted HTML page in a vulnerable Chrome build (prior to 155.0.8059.39) and interact with the WebAppInstalls UI flow (UI:R) - there is no fully passive or server-side trigger. No authentication or special privileges are needed (PR:N), and default configurations are affected, but exploitation is limited by the mandatory user interaction, the social-engineering dependency (the payoff is only deception, not code execution or data theft), and the fact that affected users are patched automatically via Chrome's update channel.

This is a genuinely low-priority issue despite a mid-range 5.4 CVSS. All exploitation signals point the same direction: the SSVC decision framework reports Exploitation=none, Automatable=no, and Technical Impact=partial, there is no CISA KEV listing, and no public exploit code was identified. Chromium itself rated the security severity 'Low'. The CVSS vector (AV:N/AC:L/PR:N/UI:R) shows the only real barrier is required user interaction (UI:R) - the victim must visit an attacker-controlled page. The C:L/I:N/A:L impact triple is modest, and for a CWE-451 UI-misrepresentation/spoofing bug the listed A:L (availability) and C:L (confidentiality) impacts are somewhat atypical; the practical harm is user deception rather than data loss or crash, so the recorded impact metrics likely overstate direct technical damage. No signals conflict - low EPSS-equivalent posture (no exploitation observed), no KEV, no POC, and a vendor patch already available all agree this is low real-world risk. It should be remediated via normal Chrome auto-update cadence, not treated as an emergency.

An attacker hosts a crafted HTML page and lures a Chrome user (pre-155.0.8059.39) to visit it. The page abuses the WebAppInstalls flow to misrepresent or spoof UI elements, making the user believe they are interacting with a trusted interface (e.g. an install or origin prompt) to facilitate social engineering. No public exploit code is known, and exploitation requires the victim to actively visit the malicious page.