Google Chrome EUVD-2026-93804

Exploitation requires a victim running Google Chrome on Windows prior to 155.0.8059.39 to load attacker-controlled HTML (UI:R), such as visiting a malicious site or an attacker-controlled frame/ad, that exercises the ANGLE graphics backend (Chrome's default WebGL/graphics translation layer, so no non-default configuration is needed). The limiting factors are: mandatory user interaction (the victim must open the crafted page), the impact being confined to out-of-sandbox memory disclosure (read-only, no code execution, no integrity/availability impact), and the requirement that the target be on the pre-patch version; the fixed build 155.0.8059.39 removes the condition entirely.

This is a genuine but comparatively low-urgency issue, not a drop-everything priority despite affecting ubiquitous software. The signals are internally consistent and point to limited real-world danger: CVSS 3.1 base score is 4.7 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - network-reachable and unauthenticated, but requiring user interaction (visiting a crafted page) and yielding only limited confidentiality impact (C:L) with no integrity or availability effect. The scope change (S:C) reflects that an uninitialized resource in ANGLE lets the renderer read memory outside the sandbox boundary, which is why Chrome rates it 'High' severity internally even though the quantitative CVSS is Medium. EPSS is low at 0.24% (13th percentile), and there is no CISA KEV listing and no public POC identified, so no evidence of active or imminent mass exploitation exists. The signals do not conflict: a Medium-CVSS information-disclosure bug with low EPSS and no KEV/POC is a routine patch-cycle item, not an emergency - though the ubiquity of Chrome and Google's 'High' internal rating argue for prompt patching. Note the Chromium severity label ('High') and the numeric CVSS (Medium) diverge because Google's rating weights sandbox-boundary crossing more heavily than the base CVSS confidentiality-only impact - this is expected, not a data error.

An attacker hosts or compromises a web page containing specially crafted content that triggers the uninitialized-resource flaw in Chrome's ANGLE graphics layer when a victim visits it. When the victim's browser renders the page, the attacker reads fragments of memory from outside the renderer sandbox, potentially leaking sensitive data such as pointers or cross-origin content. No public exploit identified at time of analysis, and successful exploitation requires the victim to actively load the malicious page.