Google Chrome EUVD-2026-93809

Exploitation requires the attacker to be on an adjacent network (AV:A) - the same broadcast domain, local subnet, or a man-in-the-middle position on the network path - and specifically targets Chrome's Proxy Auth code path, so a proxy with authentication must be in use during the victim's browsing. The high attack complexity (AC:H) indicates additional non-trivial conditions such as winning a timing/race window or specific state alignment tied to the incomplete cleanup (CWE-459). Limiting factors: no remote internet-wide exploitation is possible, the victim environment must route traffic through an authenticating proxy, and exploitation only yields disclosure of sensitive information (C:H) with no integrity or availability impact (I:N/A:N). Patched in Chrome 155.0.8059.39 and later.

This is a moderate-severity information-disclosure flaw (CVSS 5.3) whose real-world urgency is tempered by its access requirements. The provided CVSS vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N) describes an adjacent-network (AV:A), high-complexity (AC:H) attack requiring no privileges or user interaction, with high confidentiality impact (C:H) and no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of AV:A plus AC:H means an attacker must be on the same logical network segment AND win a race/timing or meet specific conditions tied to the incomplete cleanup (CWE-459), which materially lowers likelihood versus a remote network-exploitable bug. Signals are internally consistent here - a High Chromium-rated but network-adjacent, high-complexity bug reasonably maps to a mid-range CVSS. The dominant risk driver is not exploitability but prevalence: Chrome's ubiquity means even a hard-to-exploit bug affects an enormous installed base, which is why it warrants prompt patching rather than emergency response.

An attacker positioned on the same local network (e.g., shared Wi-Fi, a compromised LAN host, or a malicious intermediary proxy) sends crafted network traffic to a victim's Chrome browser during proxy authentication, exploiting memory or state that was not fully cleared (incomplete cleanup) to recover residual sensitive data such as proxy credentials or prior session information. The high attack complexity (AC:H) means the attacker must satisfy timing or configuration-dependent conditions, so exploitation is not reliably repeatable. No public exploit code was identified at time of analysis.