Google Chrome EUVD-2026-93815

Exploitation requires the victim to actively visit an attacker-crafted HTML page in Google Chrome for Android on a version prior to 155.0.8059.39 (UI:R confirmed in the CVSS vector), so social engineering to deliver and open the malicious page is the primary prerequisite. No authentication or special privileges are needed (PR:N), and no non-default configuration is indicated - the flaw lies in default Omnibox input handling. The key limiting factors are the mandatory user interaction, the Android-only scope, and the bounded impact (web origin policy bypass with only partial confidentiality/integrity exposure, no availability impact).

This is a moderate-severity, low-priority issue rather than an urgent threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) indicates remote, unauthenticated, low-complexity reach but is gated by required user interaction and yields only LOW confidentiality and integrity impact with no availability impact - consistent with a same-origin/web-origin policy bypass rather than code execution. EPSS is low at 0.18% (7th percentile), and the CVE is NOT on CISA KEV, with no public exploit identified, so all exploitation signals point to low real-world risk. The signals are coherent and non-conflicting: a high-footprint product (Chrome) but a bounded-impact flaw requiring social engineering. One nuance to verify: the input Tag labels this an 'Authentication Bypass,' but the description describes a web origin policy (same-origin) bypass - these are distinct classes, so treat the auth-bypass framing with caution. Chromium itself rated the underlying bug 'High,' which reflects browser-security severity, not the lower CVSS-derived operational risk.

An attacker uses social engineering (e.g., a phishing link or malicious ad) to lure an Android Chrome user to a crafted HTML page. The page abuses improper input validation in the Omnibox (address bar) to bypass the web origin policy, letting attacker-controlled content read or influence data that should be isolated to another origin. No public exploit code has been identified at time of analysis.