The vulnerability CVE-2026-76039 affects Google Chrome on Android versions before 151.0.7922.169. It is caused by incorrect reference resolution in the browser's core component. An attacker can exploit this by using social engineering to lure a user to a maliciously crafted HTML page, resulting in unauthorized disclosure of sensitive information. The CVSS 3.1 base score is 6.5 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high impact on confidentiality, and no impact on integrity or availability.

Successful exploitation allows a remote attacker to obtain sensitive information from the affected device without requiring privileges but requiring user interaction. The confidentiality impact is high, while integrity and availability are not affected. There are no known active exploits in the wild at this time.

Google has released a stable channel update for Chrome that addresses this vulnerability. Users should update Google Chrome on Android to version 151.0.7922.169 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.