Google Chrome EUVD-2026-93635

Exploitation requires the victim to be running Google Chrome on Android prior to 155.0.8059.39 and to visit and interact with an attacker-crafted HTML page that triggers the improper state validation in the Autofill AI feature; the Autofill AI functionality must be reachable in the user's session. Limiting factors: mandatory user interaction (the victim must load and engage with the malicious page), the platform restriction to Android, and the version ceiling - patched builds are not affected. The resulting impact is limited to UI spoofing/deception, not code execution or direct data exfiltration.

This is a low-priority issue despite a medium CVSS of 5.4. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) indicates network reach with low complexity and no privileges, but exploitation requires user interaction (UI:R) - the victim must visit and interact with a crafted page - and Google/Chromium rated the security severity explicitly as 'Low'. The impact is UI spoofing, a deception primitive rather than code execution or data theft; the C:L/A:L in the supplied vector overstates the effect, since a UI spoof is primarily an integrity/deception concern. No EPSS score, no CISA KEV listing, and no public exploit were provided, and no public exploit is identified at time of analysis. The combination of low vendor-assigned severity, mandatory user interaction, spoofing-only impact, and absence of exploitation signals means this is a hygiene patch rather than an emergency, even though Chrome's ubiquity warrants routine timely updating.

An attacker hosts or injects a crafted HTML page and lures an Android Chrome user to it; improper state validation in the Autofill AI feature lets the page spoof browser UI elements, for example to misrepresent an autofill prompt or origin and trick the user into trusting fabricated content. The attack is remote but passive, depending on the victim rendering and interacting with the malicious page. No public exploit code is identified at time of analysis.