Google Chrome EUVD-2026-93728

Exploitation requires the victim to actively visit an attacker-controlled crafted HTML page and be successfully deceived by social engineering (UI:R in the CVSS vector), making user interaction the primary limiting factor. No authentication or elevated privileges are needed (PR:N), and attack complexity is low (AC:L), but there is no automated or passive drive-by path - the attacker depends on luring the user and on the user trusting the spoofed interface. The flaw affects Google Chrome versions prior to 155.0.8059.39 across default configurations; updating to 155.0.8059.39 or later removes exposure. Impact is confined to UI deception within the browser rather than direct system compromise.

This is a genuinely medium-risk, low-priority issue despite being a Chrome vulnerability. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) reflects remote, unauthenticated reach but is materially gated by UI:R - the attacker cannot act without a victim visiting a crafted HTML page and being deceived through social engineering. Chromium itself rated the security severity as Medium, consistent with the CVSS. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals are internally consistent rather than conflicting. The vulnerability class (CWE-863, Incorrect Authorization) manifesting as UI spoofing means impact is deception rather than direct code execution or data theft, further lowering real-world priority. Note: the input 'A:L' (low availability impact) is questionable for a pure UI-spoofing flaw, which is typically an integrity/deception issue rather than availability - treat the availability characterization with caution. Because Chrome is ubiquitous, patch promptly via normal browser update channels, but this does not warrant emergency out-of-band action.

An attacker crafts a malicious HTML page and lures a victim to visit it through social engineering (phishing link, malicious ad). When rendered, the page manipulates or spoofs Chrome UI elements so the user is misled about the browser's actual state (e.g., a trusted-looking prompt or address indication), potentially enabling follow-on credential or consent trickery. No public exploit code is identified at time of analysis.