Google Chrome EUVD-2026-100638

Exploitation requires the attacker to have already compromised Chrome's renderer process (e.g. via a prior renderer RCE), and then deliver a specially crafted Chrome extension that abuses the Extensions subsystem's incorrect reference resolution to escape the sandbox. It is limited to the macOS (Mac) build of Chrome prior to 155.0.8059.79. Limiting factors: the prior renderer compromise is a hard prerequisite, CVSS marks high attack complexity (AC:H), user interaction is required (UI:R, consistent with loading/interacting with the malicious extension), and non-patched Mac installations only - these constraints make this a targeted second-stage chain rather than a standalone remote exploit.

This is a genuine high-severity sandbox escape in Google Chrome, but the signals point to meaningful real-world friction rather than mass-exploitable panic. The vendor CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, 8.3) encodes high attack complexity (AC:H), required user interaction (UI:R), and a scope change (S:C) reflecting the escape from the renderer sandbox to the host - with total impact (C:H/I:H/A:H). Critically, the description states the attacker must have ALREADY compromised the renderer process, so this is a second-stage escape rather than a standalone initial-access bug; the PR:N rating is a CVSS modeling artifact (the prior compromise is captured via S:C/AC:H), not an indication of trivial unauthenticated access. SSVC reinforces a measured prioritization: Exploitation=none, Automatable=no, Technical Impact=total - i.e. severe consequence if exploited, but not currently exploited and not scalable to automated mass attacks. There is no CISA KEV listing and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided, which is a data gap. Net: a real priority to patch given Chrome's ubiquity and total impact, but the compromised-renderer prerequisite, AC:H, and UI:R make opportunistic widespread exploitation unlikely in the near term.

An attacker who has already exploited a separate flaw to gain code execution in Chrome's renderer process on macOS leverages a crafted Chrome extension that triggers incorrect reference resolution (CWE-706) to break out of the sandbox. The chained bug then yields arbitrary code execution at the higher-privileged browser level outside the sandbox. No public exploit code was identified at the time of analysis, and the high attack complexity plus required user interaction limit casual exploitation.