Google Chrome EUVD-2026-100642

Exploitation requires that the attacker has ALREADY compromised Chrome's renderer process (a prerequisite second-stage bug or exploit chain is needed - this is not reachable from a single unprivileged visit alone), after which a crafted HTML page triggers the use-after-free in the Passwords component to execute code outside the sandbox. Affected: Google Chrome versions prior to 155.0.8059.79 (desktop stable channel). Limiting factors: the dependency on a prior renderer compromise, the high attack complexity (AC:H, reflecting a use-after-free race that must be won), and required user interaction (UI:R - the victim must load the malicious page). These factors substantially raise the bar beyond the raw 8.3 score; default configurations are affected only in the sense that any un-patched Chrome install is vulnerable once the renderer is compromised.

Signals conflict in a way that lowers real-world urgency relative to the 8.3 CVSS score. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) scores this as a high-severity network RCE with scope change, but the description makes clear this is a second-stage sandbox-escape bug: the attacker must 'have compromised the renderer process' first, so it is not independently exploitable from a single crafted page. CISA SSVC reinforces the lower practical priority - Exploitation: none (no observed activity), Automatable: no (consistent with the AC:H / UI:R race-and-chain requirement), with Technical Impact: total (consistent with C:H/I:H/A:H full code execution outside the sandbox). No EPSS score, no CISA KEV listing, and no POC were provided, so there is no public exploit identified at time of analysis. Net assessment: a genuinely serious memory-corruption bug in a ubiquitous product that warrants prompt patching, but current evidence points to no active exploitation and a non-trivial exploitation barrier (requires chaining with a separate renderer compromise), making it a patch-on-cycle High rather than an emergency-grade threat. MISSING DATA: EPSS probability and POC status are absent and cannot be inferred.

An attacker who has already achieved code execution inside Chrome's sandboxed renderer (via a separate renderer exploit) lures the victim to a crafted HTML page that triggers a use-after-free in the Passwords component. By grooming the freed object and winning the race, the attacker escapes the renderer sandbox and executes arbitrary code in the higher-privileged browser process on the host. No public proof-of-concept was provided, and the attack requires a pre-existing renderer compromise plus a successful race (CVSS AC:H).