Google Chrome EUVD-2026-93703

Exploitation requires a malicious co-installed application already present on the same Android device; that app acts as the confused deputy to make Chrome bypass system access restrictions and reach a privileged page. Limiting factors: the attack is local-only (AV:L) with no remote or network component, it depends on the attacker first getting their app installed on the victim's device (sideloading or a trojanized app), it is specific to Chrome on Android below version 155.0.8059.39, and impact is limited to partial confidentiality and integrity with no availability loss. No end-user interaction with Chrome itself (UI:N) is required once the malicious app is in place.

This is a genuinely low-to-moderate, local-only issue, not an urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.4, Chromium-rated Medium) describes a local attack requiring an attacker-controlled app already present on the device, delivering only partial (Low) confidentiality and integrity impact and no availability impact. EPSS reinforces low real-world risk at 0.11% (1st percentile). There is no CISA KEV listing and no public exploit identified, so the signals are consistent - low probability, low impact, no known exploitation. No SSVC decision data was provided in the input. The main caveat is the Low PR rating: the described prerequisite - a malicious co-installed Android app acting as the confused deputy - is a meaningful barrier that is arguably better captured than a raw score suggests, since the attacker must first get their app onto the target device. All signals point the same direction, so there is no contradiction to flag beyond that nuance.

A user is tricked into installing a seemingly benign Android app from sideloading or a store. That co-installed app abuses Chrome's UI confused-deputy flaw to have Chrome navigate to or act on a privileged internal page on its behalf, bypassing the system access restrictions that would normally block the app. No public exploit code was identified at time of analysis, and exploitation is local-only with no remote vector.