Google Chrome EUVD-2026-30469

Exploitation requires the attacker to have ALREADY compromised the renderer process (e.g., via a prior renderer RCE bug) - this is a chained privilege-escalation/sandbox-escape primitive, not a standalone remote exploit. It further requires user interaction (UI:R, loading or navigating to a crafted HTML page) and, per CVSS AC:H, specific memory-layout/timing conditions to reliably trigger the use-after-free in the Accessibility component. Limiting factors: the renderer-compromise prerequisite, high attack complexity, and the need for the victim to load attacker-controlled content substantially raise the bar; the bug affects Chrome builds prior to 148.0.7778.168 across Windows, macOS, and Linux.

Signals are consistent and point to a real-but-conditional risk rather than an internet-facing emergency. The CVSS 7.5 vector (AV:N/AC:H/PR:N/UI:R) reports network vector with no privileges, but the description contradicts the PR:N assumption: exploitation requires an attacker who has ALREADY compromised the renderer process, so this is realistically a chained sandbox-escape primitive, not a zero-click network bug - verify prioritization accordingly. SSVC aligns with low urgency: Exploitation=none, Automatable=no, but Technical Impact=total (full control if reached). EPSS is very low (0.07%, 21st percentile) and there is no KEV listing and no public exploit identified, so widespread opportunistic exploitation is unlikely. However, Chrome's ubiquity and the total technical impact mean this should still be patched promptly as part of the browser's routine security cadence, especially in environments where renderer compromise (via a separate bug) is plausible.

An attacker first uses a separate renderer exploit to gain code execution inside a Chrome tab's sandboxed renderer, then serves or navigates that tab to a crafted HTML page that manipulates the accessibility tree to trigger the use-after-free in the Accessibility component. By controlling the reclaimed memory, the attacker escalates out of the renderer into higher-privileged browser context. No public exploit code has been identified, and the multi-stage nature and high attack complexity make weaponization non-trivial.