Google Chrome CVE-2026-13891

Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process - this is the explicit, gating precondition named in the description, making the bug a sandbox-escape/privilege-escalation stage rather than an initial-access vector. It additionally requires user interaction (UI:R - the victim must load attacker content) and a crafted HTML page that feeds untrusted input to the Extensions component, and CVSS AC:H reflects that these conditions are hard to align reliably. Limiting factors: the mandatory pre-existing renderer foothold, required user interaction, high attack complexity, and the fact that only Chrome versions before 150.0.7871.47 are vulnerable substantially narrow realistic exploitation to targeted, multi-stage attacks.

Signals skew toward lower real-world urgency than the 7.5 base score suggests. The CVSS vector (AV:N/AC:H/PR:N/UI:R) encodes high attack complexity and required user interaction, and the description adds a significant prerequisite: the attacker must ALREADY control the renderer process, making this a chain component rather than a standalone remote exploit. EPSS is low at 0.22% (12th percentile) and the CVE is not in CISA KEV, indicating no known active exploitation. Note a nuance: the vector lists PR:N (unauthenticated), reflecting Chromium's convention of scoring from the web-content perspective, yet the description's 'compromised the renderer process' requirement is a real gating condition that raises practical difficulty - verify the intended attack model with the vendor. Overall this is a Medium-severity sandbox-hardening fix, worth routine patching but not an emergency.

An attacker first compromises the Chrome renderer process (for example by chaining a separate renderer RCE bug) after luring a victim to a malicious site. They then serve a crafted HTML page that supplies malformed input to the Extensions component, exploiting the input-validation gap to escalate out of the sandboxed renderer into a higher-privileged browser context. No public exploit code has been identified at time of analysis.