Google Chrome EUVD-2026-93637

Requires the victim to be running Google Chrome on Android at a version prior to 155.0.8059.39, and to be socially engineered into opening an attacker-crafted HTML page (UI:R) - the leak cannot be triggered without this user interaction. No authentication or elevated privileges are needed (PR:N) and no non-default configuration is indicated, so default Android Chrome installs are affected. The user-interaction/social-engineering requirement and the vendor's 'Low' severity rating are the key limiting factors; disclosure is confined to sensitive information handled by the Passwords component rather than full device or account compromise.

Signals conflict sharply. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) rates this as High with full confidentiality, integrity AND availability impact, yet the vulnerability is a CWE-200 information leak in Chrome's Passwords component that Google's own Chromium security team rated 'Low'. An information-disclosure flaw should not carry I:H/A:H - the supplied vector appears inflated and inconsistent with both the description and the vendor's own severity, so the 8.8 should NOT be treated as the operative priority. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so there is no evidence of active or imminent exploitation. Exploitation also requires user interaction (UI:R) driven by social engineering, which further reduces real-world risk. Net assessment: despite the headline 8.8, this is a low-to-moderate real-world priority - a vendor-rated Low info leak with a patch already available; apply the Chrome update in normal patch cycles rather than as an emergency.

An attacker socially engineers an Android Chrome user into visiting a crafted HTML page; when the victim opens it in a vulnerable Chrome build, the page triggers the Passwords-component information leak and discloses sensitive data to the attacker. No authentication is required (PR:N) but the attack cannot succeed without the victim's interaction (UI:R). No public exploit code was identified at time of analysis.