Google Chrome EUVD-2026-27979

Requires victim to visit an attacker-controlled or compromised website containing the malicious HTML/CSS payload-user interaction (UI:R in CVSS) is mandatory. No authentication required (PR:N)-affects all Chrome users regardless of login state. Exploitation succeeds against default Chrome configurations with no special features or settings required. The vulnerability exists in core CSS rendering functionality used for all web page display. Exploitation is limited by Chrome's multi-process sandbox architecture (S:U scope)-successful exploitation grants code execution only within the isolated renderer process, not the browser process or underlying operating system. Breaking out of the sandbox requires chaining with additional vulnerabilities. Attack complexity is low (AC:L) once the crafted payload is developed, as CSS processing is deterministic and not dependent on race conditions or environmental factors. Network-based delivery (AV:N) enables internet-wide exploitation without requiring local system access.

CVSS 8.8 (High) reflects network-based exploitation (AV:N) with low complexity (AC:L) requiring no privileges (PR:N) but mandatory user interaction (UI:R), achieving full confidentiality, integrity, and availability impact within the sandboxed scope (S:U). Real-world risk is elevated because browser vulnerabilities are actively targeted by adversaries, and the attack only requires convincing a user to visit a malicious page-achievable via phishing, malvertising, or watering hole attacks. The sandbox scope limitation (S:U) is critical: exploitation grants code execution only within Chrome's renderer sandbox, not full system compromise, requiring a secondary sandbox escape for broader impact. Chromium's Medium severity rating (lower than CVSS High) reflects their internal risk model accounting for sandboxing effectiveness. No CISA KEV listing suggests no confirmed widespread or targeted exploitation campaigns detected yet. No EPSS score provided for risk trending analysis. The combination of low attack complexity, no authentication requirement, and RCE capability makes this a genuine priority for Chrome users despite sandbox containment. Tagged as memory corruption with RCE and DoS potential, confirming dual exploitation paths.

Attacker hosts a specially crafted HTML page containing malicious CSS styling rules designed to trigger the use-after-free condition in Chrome's CSS parser. Victim visits the malicious page through social engineering (phishing email, compromised legitimate site, malvertising) or watering hole attack targeting specific user groups. When Chrome processes the weaponized CSS, the use-after-free is triggered, allowing the attacker to execute arbitrary code within the renderer process sandbox. From within the sandbox, attacker achieves information disclosure (stealing page content, credentials entered in forms), content manipulation, or denial of service. For full system compromise, attacker would need to chain this with a separate sandbox escape vulnerability. Public exploit code availability not confirmed from provided references.