Google Chrome EUVD-2026-93855

Exploitation specifically targets the Sync feature of Google Chrome, so the victim must be using Chrome's Sync functionality for synced sensitive information to be exposed; installations with Sync disabled are not meaningfully affected. The flaw is remote and unauthenticated (PR:N, UI:N - no user interaction required), but the CVSS High attack complexity (AC:H) indicates a significant limiting factor: the attacker must satisfy conditions outside their control (e.g., a specific race, state, or network-position dependency) rather than reliably triggering the incorrect authorization on demand. Impact is strictly confidentiality (C:H, I:N, A:N) - disclosure of sensitive synced data only, with no code execution, data tampering, or denial of service. All versions of Chrome prior to 155.0.8059.39 are affected.

This is a genuinely moderate-priority issue, not an inflated high-CVSS item. All signals align downward: the provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) yields 5.9, driven entirely by a High confidentiality impact (C:H) but tempered by High attack complexity (AC:H), meaning exploitation requires specific conditions or a race/state that the attacker does not fully control. The CISA SSVC framework reinforces this: Exploitation=none (no observed activity), Automatable=no (cannot be reliably scripted at scale), and Technical Impact=partial (confidentiality-only, no integrity or availability loss). There is no CISA KEV listing and no EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified - but the SSVC 'none/no' combination strongly suggests this is not under active or automated attack. Chromium's own severity rating is Medium, consistent with the 5.9 base score. The one amplifying factor is prevalence: Chrome is ubiquitous, so even a medium-severity authorization flaw in the Sync feature has an enormous installed base. Net assessment: patch on a normal cadence; this is not an emergency. No conflicting signals were found between the CVSS vector and the description - both indicate remote, high-complexity, confidentiality-only impact.

A remote attacker crafts and sends specially-formed network traffic to a victim's Chrome Sync data flow, exploiting an incorrect-authorization check (CWE-863) to read sensitive synced information they should not be authorized to access. Because attack complexity is High, success depends on specific timing or state conditions outside the attacker's direct control, and no public exploit code has been identified at time of analysis.