Google Chrome EUVD-2026-93735

Exploitation requires the ReadingList feature path in Google Chrome for Android (versions prior to 155.0.8059.39) and, critically, active victim interaction: the user must be socially engineered into loading an attacker-crafted HTML page (UI:R). The attack is cross-site request forgery (CWE-352), so it leverages the victim's existing in-browser context rather than needing attacker authentication (PR:N). Limiting factors that reduce real-world risk: the dependency on user interaction and social engineering, the Android-only scope (desktop/iOS Chrome not implicated by this description), and the low technical impact (limited confidentiality and integrity, no availability), which together make large-scale or automated exploitation impractical.

This is a genuinely medium-tier issue, and the signals are largely consistent in pointing away from urgent, widespread priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless REQUIRES user interaction (UI:R) and yields only low confidentiality and low integrity impact with no availability impact. EPSS reinforces low urgency at 0.18% (7th percentile), and the vulnerability is NOT in CISA KEV. SSVC reports Exploitation: none and Automatable: no, which aligns with EPSS and the UI:R requirement - a CSRF needing social engineering is inherently hard to automate at scale. One notable CONFLICT: SSVC Technical Impact is labeled 'total', which contradicts the CVSS impact metrics (only C:L/I:L, no availability) and Chromium's own 'Medium' severity rating; the SSVC 'total' value should not be read as indicating full system compromise here and appears inconsistent with the CWE-352 CSRF nature of the bug. Net: a real but low-priority issue for most defenders - patch in normal cadence. The one counterweight is prevalence (Chrome on Android is ubiquitous), so the aggregate exposed population is large even though per-target exploitation is low-probability and interaction-gated.

An attacker crafts a malicious HTML page and lures an Android Chrome user to visit it via social engineering (phishing link, malicious ad, or compromised site). When the page loads, it issues a forged cross-origin request that the ReadingList feature processes in the victim's authenticated context, bypassing web origin policy to read or modify limited data. No public exploit code has been identified at time of analysis.