Google Chrome EUVD-2026-93647

Exploitation requires the victim to actively open an attacker-crafted HTML page (UI:R) and specifically targets the Payments component of Chrome, so the user must be lured via social engineering into visiting malicious content while running a build prior to 155.0.8059.39. There is no authentication requirement (PR:N) and the attack is network-delivered, but the mandatory user interaction and social-engineering dependency are the primary limiting factors; no non-default configuration is indicated. Realistic impact is confined to disclosure of sensitive information handled by the Payments feature, not integrity or availability loss.

Signals conflict sharply and must be reconciled before prioritization. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) implies full compromise of confidentiality, integrity AND availability, yet the description characterizes this strictly as an information leak in the Payments component (CWE-200) and Google's own Chromium security team rates the severity 'Low'. The I:H/A:H impacts in the NVD vector are almost certainly inflated boilerplate - an information-disclosure flaw does not plausibly grant integrity or availability impact - so the 8.8 should be treated with skepticism and the vendor's 'Low' rating given substantial weight. No EPSS score was supplied, and there is no CISA KEV listing and no public proof-of-concept, so there is no evidence of active or imminent exploitation. Exploitation also requires user interaction via social engineering (UI:R), which further lowers real-world risk. Net assessment: despite the headline 8.8, this is a low-priority, patch-in-normal-cycle issue - a high-CVSS-but-low-real-risk case driven by Chrome's near-universal footprint rather than by severity or exploitability.

An attacker crafts a malicious HTML page and uses social engineering (e.g., a phishing lure or deceptive link) to persuade a victim to open it in a vulnerable Chrome build, whereupon flawed handling in the Payments component leaks sensitive information to the attacker. No public exploit code was identified, and successful exploitation depends on the victim being tricked into the required interaction. Impact is limited to disclosure of sensitive data rather than code execution.