Google Chrome EUVD-2026-93730

Exploitation requires the victim to use an affected Google Chrome build (any version prior to 155.0.8059.39) and to actively visit an attacker-controlled crafted HTML page (UI:R - user interaction is the primary limiting factor). The flaw resides specifically in FedCM (the Federated Credential Management API), so meaningful impact depends on the presence and use of federated identity / sign-in flows that FedCM mediates; environments or sessions not exercising federated login have reduced practical exposure. No authentication or elevated privileges are required (PR:N), and default configurations are affected since FedCM is a built-in browser feature, but the requirement for user navigation to a malicious page meaningfully limits mass or drive-by-at-scale exploitation (SSVC Automatable=no).

This is a medium-severity, moderate-priority issue that does not warrant emergency patching but should be addressed through normal Chrome auto-update cycles. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, 6.5) indicates a network-reachable flaw requiring low complexity and no privileges but mandating user interaction (the victim must visit a crafted HTML page), with impact limited to integrity (I:H) and no confidentiality or availability effect. All exploitation and risk signals agree that real-world risk is low-to-moderate: EPSS is 0.19% (8th percentile), CISA SSVC scores Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no public exploit identified at time of analysis. No conflicting signals are present - the CVSS vector, Chromium's own 'Medium' severity rating, low EPSS, and SSVC all converge on a non-urgent profile. The one caveat is the integrity-only I:H rating, which reflects the web origin / same-origin policy bypass in FedCM (federated identity) rather than direct code execution; the practical consequence (cross-origin identity/credential disclosure or spoofing) depends on FedCM relying-party deployments and is not fully detailed in the available data.

An attacker hosts a crafted HTML page and lures a Chrome user (prior to 155.0.8059.39) to visit it. The page abuses the missing authorization check in FedCM to bypass the web origin policy, allowing the attacker's origin to interact with federated identity flows it should not be permitted to access. No public proof-of-concept exploit has been identified at time of analysis, and exploitation requires the victim to actively load the malicious page.