Google Chrome EUVD-2026-93627

Exploitation requires the victim to actively navigate their Android Chrome browser (versions prior to 155.0.8059.39) to a crafted attacker-controlled HTML page (UI:R in the CVSS vector confirms required user interaction). No authentication or special privileges are needed (PR:N), and no non-default configuration is required. The primary limiting factor is the mandatory user interaction and the fact that impact is confined to UI deception - the attacker cannot execute code or directly read data; realistic harm depends on the user being successfully tricked by the spoofed interface. Platform is limited to Chrome on Android.

This is a low-priority issue despite a mid-range CVSS base score of 5.4. The provided CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) indicates a network-reachable, low-complexity flaw requiring no privileges but requiring user interaction, with only low confidentiality and availability impact and no integrity impact - consistent with a UI spoofing/misrepresentation weakness (CWE-451) rather than code execution. Google/Chromium themselves rated the security severity 'Low'. The SSVC decision framework reinforces de-prioritization: Exploitation=none (no observed or expected exploitation), Automatable=no, Technical Impact=partial. There is no KEV listing and no indication of public exploit code, so this is 'no public exploit identified at time of analysis'. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. One minor internal tension: the CVSS vector lists A:L (availability impact), which is unusual for a pure UI-spoofing bug where the realistic harm is user deception leading to possible credential/information disclosure rather than an availability effect - treat the A:L as questionable and vendor-derived. Overall this is a genuinely low-risk, deception-class issue that matters mainly for phishing-style social engineering, not a widespread or automatable threat.

A remote attacker hosts a crafted HTML page and lures an Android Chrome user to visit it; the page manipulates browser UI elements (such as address bar or security indicators) to misrepresent the page's true origin or state. The user, trusting the spoofed UI, may be deceived into disclosing credentials or sensitive data. No public exploit code is identified, and successful exploitation requires the victim to actively load the malicious page (UI:R).