Google Chrome EUVD-2026-93678

Exploitation requires the victim to be running Google Chrome on Android at a version below 155.0.8059.39 AND to perform the attacker-desired interaction described as 'social engineering' (UI:R) - e.g. visiting or interacting with an attacker-controlled page that delivers crafted network traffic to the Omnibox code path. There is no authentication requirement (PR:N), but the mandatory user-interaction step is the primary limiting factor: the attack cannot succeed fully silently and depends on successful user lure. Scope is unchanged (S:U) and impact is confined to confidentiality (information disclosure), with no integrity or availability effect. The flaw is Android-specific, so desktop/iOS Chrome deployments are not in scope per the advisory.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N = 6.5) describes a remote, unauthenticated, low-complexity information disclosure whose only real gate is required user interaction (UI:R) - consistent with the description's 'leveraging social engineering.' Impact is confidentiality-only (C:H/I:N/A:N), matching CWE-200 and Chromium's own 'Medium' severity rating. The risk signals are internally consistent and point AWAY from urgency: EPSS is very low at 0.20% (9th percentile), there is no CISA KEV listing (no confirmed active exploitation), and no public exploit code was identified in the provided data. No SSVC decision data was supplied. The one tension worth noting is scope-of-impact: the vector rates C:H (high confidentiality loss) yet the vendor rated the overall bug only 'Medium,' which typically reflects that the leaked data is sensitive but bounded rather than a full credential/same-origin compromise - treat C:H as the worst-case and verify the exact data exposed against the Chromium issue tracker. Bottom line: patch via normal update cadence; the reliance on user interaction plus low EPSS and absent exploitation evidence make widespread opportunistic attacks unlikely.

An attacker lures an Android Chrome user to a malicious or attacker-influenced page and gets them to interact with it (the UI:R / social-engineering prerequisite). The page serves crafted network traffic that triggers the Omnibox information-leak flaw, causing the browser to disclose sensitive information back to the attacker. No public exploit code was identified at time of analysis, so this remains a plausible but unproven attack path.