Google Chrome EUVD-2026-93757

Exploitation targets the Autofill feature of Google Chrome on versions prior to 155.0.8059.39 and requires the attacker to host a specially crafted HTML page AND successfully apply social engineering to get the victim to visit and interact with it (UI:R). The limiting factors that reduce realistic risk: the attack cannot succeed silently - it depends on victim interaction with an Autofill-related prompt/flow, it depends on the victim having relevant sensitive data stored in Chrome Autofill for the disclosure to be meaningful, and it is defeated entirely by updating to 155.0.8059.39 or later (automatic for most Chrome installs). There is no indication the flaw works against a fully patched browser or without any user action.

The input presents a significant internal conflict that must be resolved before prioritization. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates full compromise of confidentiality, integrity, AND availability - yet both the Chromium security severity label ('Medium') and the description ('allowed a remote attacker ... to obtain sensitive information') point to a confidentiality-only information-disclosure issue with NO integrity or availability impact. This 8.8 is almost certainly the generic high score auto-assigned to Chrome CVEs rather than a flaw-specific assessment; treat the C:H/I:H/A:H component as unreliable and weight the vendor's Medium rating and the CWE-863 (incorrect authorization) classification more heavily. On exploitation signals: no EPSS score is provided, there is no CISA KEV listing, and no public exploit (POC) is indicated - so per the precision rules this is 'no public exploit identified at time of analysis.' Exploitation also requires user interaction (UI:R) and explicit social engineering, which materially lowers real-world risk versus a drive-by. Net assessment: this is a real but moderate-priority issue - a widely deployed product (Chrome) elevates aggregate exposure, but the medium technical impact, required user interaction, social-engineering dependency, and absence of any exploitation evidence argue against emergency treatment. Patch on the normal Chrome update cadence; the browser's auto-update will remediate most of the fleet. SSVC-style read: exploitation=none, automatable=no (requires human social engineering), technical impact=partial.

An attacker lures a victim to a crafted HTML page (e.g., via phishing link or malicious ad) and uses social-engineering cues to induce the victim to interact with an Autofill prompt. Due to incorrect authorization in Autofill, the page improperly obtains sensitive autofill data (such as saved addresses or form values) that it should not have access to. No public exploit code is identified at time of analysis, and user interaction is required.