Google Chrome CVE-2026-84331

Exploitation requires two compounded preconditions: (1) the attacker must have already achieved code execution within the Chrome renderer process via a separate vulnerability - without this, the Actor authorization flaw is unreachable; and (2) the victim user must interact with a crafted HTML page (UI:R). The renderer compromise precondition substantially limits real-world exploitability - this is not directly exploitable from a network position alone. Confidentiality impact is limited to partial cross-origin data access (C:L); there is no integrity or availability impact. Default Chrome configurations are no more exposed than hardened ones, since the precondition is an independent renderer compromise, not a specific feature toggle.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, score 3.1) reflects the significant precondition: the attacker must have already compromised the Chrome renderer process via a separate, unrelated vulnerability before this flaw becomes exploitable. AC:H encodes that dependency directly. SSVC assessment aligns - exploitation status is none, the attack is not automatable, and technical impact is only partial (C:L). This is a sandbox-assist or exploit-chain component rather than a standalone exploitable flaw. Real-world priority is low absent a paired renderer-compromise vulnerability being exploited in the wild. No KEV listing, no public exploit code. EPSS data not provided; the compound exploitation requirement makes mass exploitation unlikely. The only meaningful risk elevation would occur in a targeted attack scenario where an adversary chains this with a separate renderer RCE.

An attacker would first need to exploit a separate renderer-process vulnerability in Chrome to gain code execution within the sandboxed renderer. With that foothold, they would serve or direct the victim to a crafted HTML page that triggers the Actor authorization flaw, causing the renderer to make cross-origin requests that should be blocked by web origin policy, potentially reading limited data from a cross-origin context. No public exploit code exists for this specific issue.