Google Chrome EUVD-2026-93633

Exploitation requires the victim to open an attacker-crafted HTML page in Google Chrome for Android prior to 155.0.8059.39 (default configuration is sufficient - no special feature or setting must be enabled). No authentication is required (PR:N). The principal limiting factor is mandatory user interaction (UI:R): the attacker cannot trigger the spoof passively and must socially engineer the user into visiting the malicious page and then trusting the falsified UI; impact is confined to the Android Chrome client and does not yield code execution or direct data compromise.

This is a low-priority issue despite a mid-range CVSS 3.1 base score of 5.4. All exploitation signals point to minimal real-world risk: Chromium itself rated the security severity 'Low', CISA SSVC scores Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. The CVSS vector (AV:N/AC:L/PR:N/UI:R) shows the flaw is network-reachable and needs no privileges, but it mandates user interaction (UI:R) and the impact is limited to UI spoofing/misrepresentation (CWE-451) rather than code execution or data theft. There is no KEV listing, no public POC identified, and no EPSS score supplied in the input, so there is no evidence of active or imminent exploitation. Note a conflict worth flagging: the provided CVSS vector lists C:L/A:L for what the description characterizes as a pure UI spoofing bug - a spoofing/misrepresentation weakness maps more naturally to a low integrity impact (I:L) than to confidentiality/availability loss, so the vendor-style vector appears imprecise. Also note the EUVD description and CWE-451 describe UI spoofing, yet the input tag 'Information Disclosure' is a loose fit. Bottom line: a genuine but low-severity client-side deception bug; patch via routine Chrome update cadence, not emergency response.

An attacker hosts or injects a crafted HTML page and lures an Android Chrome user to open it; the page manipulates browser UI elements (e.g., address bar or security indicators) so the rendered interface misrepresents the true origin or state. The victim, trusting the spoofed UI, is deceived into treating attacker-controlled content as legitimate, enabling phishing or social-engineering follow-on. No public exploit code was identified at time of analysis, and the attack requires the victim to actively visit the malicious page (UI:R).