Google Chrome EUVD-2026-93800

Exploitation requires the victim to use Google Chrome on Android and to open attacker-controlled content rendered through the CustomTabs feature (UI:R - the user must load the crafted HTML page). The flaw is an incomplete cleanup (CWE-459) of CustomTabs state that enables a web-origin-policy bypass; it does not require authentication (PR:N) or any special victim-side configuration beyond normal CustomTabs usage. Limiting factors: the attack is confined to Android Chrome versions prior to 155.0.8059.39, succeeds only against users who are induced to open the malicious page, and yields only partial (Low) confidentiality/integrity impact with no availability effect and no scope change (S:U), so it cannot by itself achieve full account takeover or code execution.

This is a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (the victim must load a crafted HTML page) and yields only Low confidentiality and Low integrity impact with no availability effect - consistent with an origin-policy/sandboxing weakness rather than full code execution. Real-world signals reinforce the 'medium' read: EPSS is 0.20% (9th percentile), indicating very low near-term mass-exploitation probability; the CVE is NOT in CISA KEV; and no public POC is referenced. No SSVC decision record is provided in the input, so exploitation status, automatability, and technical-impact classifications cannot be cited - this is a gap. The signals are internally consistent (low EPSS, no KEV, UI-dependent, partial impact all point the same direction), so this reads as a genuinely lower-urgency High-severity-by-Chromium-labeling issue rather than a conflicting-data situation. Note the Chromium 'High' severity label reflects browser-project impact conventions and should not be conflated with an NVD/CVSS 'High' rating, which this is not (5.4 = Medium).

An attacker hosts a malicious web page and lures an Android Chrome user to open it, typically via a link that invokes a Custom Tab. The incomplete cleanup in CustomTabs lets the crafted page bypass the web origin policy, allowing it to read or influence content it should be isolated from across origins. No public exploit code is referenced, and the attack depends on the victim actually opening the attacker-controlled page.