Google Chrome CVE-2026-84353

Exploitation requires the victim to open a crafted HTML page in Google Chrome on Android (UI:R) - attacker-driven social engineering is explicitly required, so it is not a fully drive-by/zero-click bug and depends on user action. The vulnerable code path is the Shared Tab Groups feature, so the victim's Chrome must reach that component while rendering the malicious page. No authentication or elevated privileges are needed (PR:N), and it works remotely against affected default Chrome installs on Android below 152.0.7977.75. The limiting factors are the required user interaction and the platform constraint (Android; the desktop-titled advisory should be cross-checked).

This is a genuine high-priority issue rather than an inflated CVSS number. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H yields 9.6: network-reachable, low complexity, no privileges, but requiring user interaction (visiting a malicious page). The scope change and full C/I/A impact reflect a sandbox escape, the most severe outcome for a browser bug. The only meaningful attacker-side friction is UI:R combined with the description's 'social engineering' requirement - the victim must be induced to open attacker content. No EPSS score, KEV listing, or POC is present in the supplied data, so exploitation is currently theoretical/undemonstrated in public sources; however, browser UAF sandbox escapes are historically high-value and frequently weaponized, so the absence of a POC should not lower urgency. Note the primary vendor reference is titled 'Stable Channel Update for Desktop' while the CVE explicitly scopes the bug to Android - verify the exact affected platform/channel against the Chromium issue tracker.

An attacker crafts a malicious HTML page that manipulates Chrome's Shared Tab Groups logic to trigger the use-after-free, then uses social engineering (a phishing link, malicious ad, or compromised site) to get an Android user to open it. When the victim loads the page, the stale pointer is reused to gain code execution outside the browser sandbox on the device. No public exploit code has been identified at time of analysis, but the low attack complexity makes weaponization plausible.