Google Chrome EUVD-2026-93731

Exploitation requires the victim to load an attacker-controlled crafted HTML page in a vulnerable Chrome build (prior to 155.0.8059.39) that triggers the flaw in the Animation component - this mandatory user interaction (UI:R) is the primary limiting factor. No authentication or special privilege is needed (PR:N), and no non-default Chrome configuration is required; the bug is reachable against a default browser install simply by rendering the malicious page. Impact is bounded to a partial cross-origin confidentiality leak (same-origin-policy boundary), not code execution, and exposure is further limited by Chrome's automatic background update, which removes the vulnerable version once the fix propagates.

This is a genuine but low-urgency issue, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3, Medium) describes a network-reachable, low-complexity, unauthenticated bug whose only impact is a partial loss of confidentiality (C:L) with no integrity or availability effect - matching the CWE-200 information-leak classification and the 'leak cross-origin data' description. CISA's SSVC framework reinforces low priority: Exploitation=none (no observed or public exploitation), Automatable=no, and Technical Impact=partial, which aligns with the C:L/I:N/A:N impact. There is no CISA KEV listing and no EPSS score was provided in the input, so exploitation probability cannot be quantified from this data; however, the absence of KEV plus SSVC Exploitation=none indicates no evidence of in-the-wild use. Google rates this Medium severity, and the only true limiting factor - mandatory user interaction (UI:R, the victim must open a crafted page) combined with the fact that it leaks data rather than grants code execution - keeps real-world risk modest. Net: a legitimate cross-origin confidentiality bug worth patching in the normal browser-update cycle, not an emergency. The dominant mitigating signal is Chrome's automatic update mechanism, which rapidly closes exposure once the fix channel ships.

An attacker hosts a crafted HTML page that abuses the Animation component to read data belonging to another origin, then lures a victim into visiting it (e.g., via a link or malicious ad). When the page loads, the flaw leaks a limited amount of cross-origin information (such as content the victim is authenticated to on another site) back to the attacker. No public exploit code has been identified at time of analysis, and successful exploitation requires the victim to actively open the attacker-controlled page.