Google Chrome EUVD-2026-93634

Exploitation requires the victim to be socially engineered into visiting attacker-controlled content or triggering attacker-supplied network traffic in Chrome - this mandatory user interaction (CVSS UI:R) is the primary limiting factor and prevents silent, drive-by or server-side exploitation. No authentication or prior privileges are needed (PR:N), and default Chrome configurations prior to 155.0.8059.39 on affected desktop builds are vulnerable; there is no indication a non-default setting or specific feature flag is required. The practical blast radius is further constrained by the integrity-only, scope-unchanged impact (C:N/I:H/A:N, S:U): the flaw bypasses the web origin policy but does not, per available data, grant code execution, credential theft, or availability loss.

This is a moderate-severity, low-priority issue despite the 6.5 CVSS base score. Multiple signals align toward low real-world risk: Chromium's own severity rating is 'Low', EPSS is only 0.17% (6th percentile, i.e. very low modeled exploitation probability), the vulnerability is NOT in CISA KEV, and no public proof-of-concept is referenced in the provided data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates a network-reachable, unauthenticated flaw with low attack complexity but requiring user interaction (UI:R) - consistent with the description's reliance on social engineering. Impact is scoped to integrity only (C:N/I:H/A:N), meaning a web-origin / same-origin-policy bypass rather than code execution or data theft. The signals are internally consistent and non-conflicting: a network vector gated by mandatory user interaction, modest integrity-only impact, no evidence of active exploitation, and vendor-confirmed low severity. The exploitation status is: no public exploit identified at time of analysis. Overall this is a 'patch in normal cycle' issue, not an emergency - the headline CVSS of 6.5 overstates practical urgency given the required social-engineering step and integrity-only, non-privilege-escalating impact.

An attacker crafts a malicious web page or network response and lures a Chrome user (via phishing, a malicious link, or a compromised ad/site) into visiting it. Because of the missing authorization check in Chrome's network stack, the crafted traffic bypasses the web origin policy, letting attacker-controlled script influence or access content across a security origin boundary it should not reach. No public exploit code is identified at time of analysis, and the attack requires the victim to actively interact (UI:R), limiting it to targeted social-engineering campaigns rather than drive-by mass exploitation.