Google Chrome CVE-2026-84350

Exploitation requires a victim running Google Chrome prior to 152.0.7977.75 on any desktop platform to perform an active UI interaction with attacker-controlled tab-related content - social engineering is the explicit delivery mechanism per the description, confirming UI:R. The use-after-free is in the TabStrip subsystem, meaning the triggering interaction involves tab management behavior. No authentication is required from the attacker (PR:N per CVSS). No non-default Chrome configuration is documented as required - any default desktop Chrome install below the patched version is in scope. The practical limiting factor is the social engineering requirement, which prevents automated mass exploitation and requires per-victim interaction.

The CVSS 8.8 base score reflects a network-reachable, unauthenticated attack path with high C/I/A impact, but Google's internal Chromium severity rating of 'Low' signals the practical exploitation bar is substantially higher than the base score alone implies - the mandatory UI:R social-engineering step prevents automated drive-by exploitation. A notable inconsistency exists in the submitted CVSS vector: S:U (unchanged scope) conflicts directly with the description's 'outside the sandbox' language; sandbox escapes in Chromium invariably represent a scope change (S:C) affecting the host OS beyond the renderer, suggesting the effective impact is higher and the submitted vector may be a scoring artifact worth verifying against the Chromium tracker (issues.chromium.org/issues/513713427). No CISA KEV listing and no public exploit code have been identified, placing this squarely in the 'patch promptly but not crisis-response' tier absent additional intelligence. EPSS data was not provided, leaving probability-of-exploitation-in-the-wild assessment incomplete.

An attacker sends a phishing email or places a malicious advertisement that directs a Chrome user to a crafted webpage, then manipulates the page to prompt a specific tab-UI interaction (such as dragging, closing, or switching tabs in a scripted sequence). This triggers the use-after-free in the TabStrip component; the attacker's controlled memory layout causes arbitrary code to execute in the browser process, outside the renderer sandbox, granting host-level code execution. No proof-of-concept exploit has been identified, making exploitation currently contingent on original exploit development.