Google Chrome CVE-2026-84349

Exploitation requires two distinct conditions to be met simultaneously: (1) the attacker must have already achieved code execution inside the Chrome renderer process, typically through a separate vulnerability such as a JavaScript engine bug or memory corruption in Blink; and (2) the victim user must visit or be directed to a crafted HTML page that triggers the UAF in the Browser process. Exploitation is limited to desktop Chrome versions prior to 152.0.7977.75. There is no privilege requirement on the attacker's end, but the renderer compromise prerequisite substantially raises the effective attack complexity beyond what AC:H alone conveys - this is not exploitable without an independent renderer exploit. Platforms affected are not explicitly listed in the advisory beyond 'desktop', so mobile/ChromeOS exposure is unconfirmed.

The CVSS 8.3 score (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) accurately reflects the dual nature of this vulnerability: it is network-reachable and requires no authentication, but AC:H correctly captures the elevated complexity caused by the mandatory prerequisite of a prior renderer compromise. In practice this means CVE-2026-84349 is a second-stage component in a two-bug chain, not a standalone RCE - the real-world exploitability is therefore substantially constrained compared to what the raw impact metrics suggest. No EPSS score was supplied in the input; no CISA KEV listing exists, and no public POC has been identified. Despite these mitigating signals, Chrome's ubiquitous deployment and the historically aggressive exploitation of browser sandbox-escape chains by APT and criminal actors mean this should be treated as a high operational priority for any organization that has not yet deployed 152.0.7977.75. Google's own classification of 'High' (Chromium severity scale) aligns with the 8.3 CVSS score.

An attacker first exploits a separate renderer vulnerability (e.g., a V8 or Blink bug) to gain code execution inside the sandboxed Chrome renderer process, then serves a crafted HTML page that triggers the use-after-free in the Browser process, redirecting execution to attacker shellcode running with the privileges of the Chrome browser process outside the sandbox. No public proof-of-concept exploit has been identified at time of analysis, but this exploit pattern (renderer-to-browser two-stage chain) is well-understood and has been used in prior Chrome exploitation campaigns.