Google Chrome EUVD-2026-100643

Exploitation requires the attacker to already be able to run a local program on the target host - i.e., pre-existing unprivileged local code execution - which then abuses an incorrect authorization check in Chrome's Updater to break out of the sandbox. The supplied vector's UI:R indicates user interaction is also a limiting factor. These prerequisites (local foothold plus interaction) meaningfully constrain exploitation: it is not remotely or network-reachable despite the AV:N label, and it cannot be automated at scale (SSVC Automatable=no). It affects Chrome builds prior to 155.0.8059.79 across desktop; updating to 155.0.8059.79 or later remediates it.

Signals conflict sharply and must be reconciled before prioritization. The input CVSS of 9.6 is driven by AV:N (network) with scope change (S:C) and total CIA impact, but the description explicitly states this is a LOCAL attacker executing code outside the sandbox 'via a local program' - the AV:N metric is almost certainly a mis-score and the real attack vector is local (AV:L). This is a common artifact of Chrome's severity mapping and should be verified; treated as a truly local sandbox-escape/privilege issue, real-world severity is meaningfully lower than 9.6 implies. The SSVC framework reinforces the lower-urgency read: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be mass/worm-automated, consistent with a local prerequisite), though Technical Impact=total (full compromise once triggered). No KEV listing and no POC are present in the data, so exploitation status is 'no public exploit identified at time of analysis.' Net assessment: this is a legitimate high-impact sandbox-escape bug warranting prompt patching as part of normal Chrome update hygiene, but it is NOT an actively-exploited, remotely-wormable emergency - the headline 9.6 overstates real-world risk because it treats a local-prerequisite flaw as network-reachable.

An attacker who can already run an unprivileged local program on the victim's machine (e.g., via a prior malware foothold or a compromised low-privilege account) abuses the incorrect authorization check in Chrome's Updater component to execute arbitrary code outside the browser sandbox, escalating beyond the renderer's confinement. Because AC is low, triggering is reliable once local code execution is achieved, but the local-program prerequisite and required user interaction limit opportunistic use. No public exploit code was identified at time of analysis.