Google Chrome EUVD-2026-30461

Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process on a Windows host (a precondition typically obtained via a separate vulnerability), and then to deliver a crafted HTML page that abuses the Passwords policy-enforcement gap - this maps to the CVSS AC:H and UI:R metrics. Limiting factors: the bug is not exploitable from a clean renderer, it is scoped to the Windows platform per the Chromium note, it affects only Chrome versions prior to 148.0.7778.168, and it needs the victim to interact with attacker content. It is not a remote unauthenticated one-shot despite the PR:N notation, precisely because the renderer-compromise prerequisite gates the whole attack.

The signals are consistent and point to a genuine-but-conditional risk rather than an emergency. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.5) reports network vector with no privileges, but the description makes clear this is misleading in isolation: successful exploitation requires the attacker to have ALREADY compromised the renderer process, which is itself a prerequisite achieved via a separate bug - hence the High attack complexity and required user interaction. EPSS is very low (0.07%) and SSVC records Exploitation: none, Automatable: no, so there is no evidence of active or automated exploitation; SSVC Technical Impact: total reflects the full C/I/A impact once the precondition is met. KEV status is not present, and no POC is referenced. Net: this is a chain-completion vulnerability whose real-world priority is driven by Chrome's ubiquity and patch hygiene, not by imminent standalone exploitation. Note the tension worth flagging to defenders - PR:N understates the practical barrier, since a compromised renderer is effectively required.

An attacker first compromises Chrome's renderer process using a separate memory-corruption or logic bug delivered through a malicious or compromised web page the victim visits. From inside that sandboxed renderer, the attacker serves a crafted HTML page that abuses the insufficient policy enforcement in the Passwords component to escalate privileges beyond the renderer's intended boundary. No public exploit is identified at time of analysis, and the high attack complexity plus required user interaction make this a targeted chain-completion step rather than a mass-exploitation vector.