Google Chrome EUVD-2026-93718

Exploitation requires a victim running Google Chrome for Android on a version prior to 155.0.8059.39 to actively load attacker-controlled crafted HTML (UI:R) - e.g., by visiting a malicious or compromised web page. No authentication or prior privileges are needed (PR:N) and the attack is network-delivered (AV:N), but the mandatory user-navigation step and the Android-only, pre-patch version constraint meaningfully limit opportunistic exploitation. The specific abuse targets the SignIn component acting as a confused deputy to reach a privileged internal page; no non-default configuration is indicated as required.

This is a genuinely moderate-priority issue rather than a top-tier emergency, and the signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N, base 7.1) indicates a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) - the victim must open or navigate to a crafted HTML page. That UI:R requirement is the single biggest brake on real-world risk. EPSS corroborates a low near-term exploitation likelihood at 0.22% (12th percentile), the vulnerability is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Chromium itself rated the security severity only Medium, which aligns with the UI-gated, scope-unchanged (S:U) confused-deputy nature of the bug. The one notable tension is the C:H / I:L / A:N impact: the high confidentiality rating stems from bypassing access restrictions to reach a privileged internal page, but the description does not spell out exactly what data that privileged SignIn page exposes - treat C:H as vendor-assigned rather than independently verified. No SSVC decision record was provided. Overall: patch promptly given Chrome's enormous footprint, but this is a medium-severity, user-interaction-dependent issue, not evidence of active mass exploitation.

An attacker hosts or compromises a web page containing crafted HTML that abuses the SignIn component as a confused deputy; when an Android Chrome user (prior to 155.0.8059.39) is lured into visiting it, the page causes the browser to act with its own privileges and reach an internal privileged page the attacker should not be able to access, bypassing system access restrictions. No authentication is required but the victim must load the malicious page (UI:R). No public exploit code has been identified at the time of analysis.