Google Chrome EUVD-2026-93762

Exploitation requires the victim to load an attacker-controlled or compromised web page that exercises Chrome's ANGLE graphics backend (the layer translating WebGL/OpenGL ES calls), triggering an out-of-bounds read; per UI:R the attack cannot succeed without this user interaction. It affects Google Chrome versions prior to 155.0.8059.39 and is remediated by updating to that release or later. Although PR:N means no authentication is needed, the required user interaction and the disclosure-only (C:L, no I/A) nature materially limit real-world risk; the flaw leaks memory across the sandbox boundary (S:C) but does not by itself grant code execution.

This is a genuinely low-to-moderate priority issue despite being a browser vulnerability, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, base 4.7, Chromium-rated Medium) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (victim must open a crafted page) and yields only limited confidentiality impact (C:L) with no integrity or availability effect - it is a memory-disclosure bug, not code execution. EPSS reinforces low urgency at 0.18% (6th percentile), indicating very low near-term exploitation probability. The vulnerability is NOT on the CISA KEV list and there is no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. The scope change (S:C) is meaningful - the out-of-bounds read in ANGLE lets a renderer-context attacker read memory outside the sandbox boundary - but the impact remains an information leak rather than a sandbox-escaping RCE. Net: a real bug worth patching on normal cadence, but not an emergency; the low CVSS, low EPSS, absence of KEV/POC, and disclosure-only impact all agree.

An attacker hosts or compromises a web page containing crafted HTML/WebGL content that drives Chrome's ANGLE graphics layer into an out-of-bounds read. When a victim visits the page, the attacker leaks small amounts of memory contents from outside the renderer sandbox, potentially exposing sensitive data or defeating memory-layout protections. No public exploit code is known, and exploitation requires the victim to actively load attacker-controlled content (UI:R).