Google Chrome EUVD-2026-34506

Exploitation requires four concrete prerequisites that all must hold: (1) the victim runs Chrome for Windows at a version below 149.0.7827.53 - Chrome on macOS, Linux, Android, and iOS is not in scope because the bug is in the Windows-specific CredentialProvider integration; (2) the attacker must have already compromised the renderer process via a separate vulnerability - this CVE is a sandbox-escape primitive, not an initial-access bug; (3) the user must interact with a crafted HTML page (CVSS UI:R), meaning a click, navigation, or similar action is needed to reach the vulnerable code path; and (4) attack complexity is High (CVSS AC:H), implying timing, heap layout, or other non-trivial conditions must be met for the integer overflow to wrap reliably. Note: the CVSS vector lists PR:N, but the description's renderer-compromise prerequisite is a meaningful real-world limiter that PR:N does not capture.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.5 (High), but several signals temper the real-world urgency: attack complexity is High, user interaction is Required, and - most importantly - the description states the attacker must have ALREADY compromised the renderer process, which the CVSS scope (S:U) and PR:N do not fully reflect. This is effectively the second link in a two-bug exploit chain, not a standalone remote attack. There is no public exploit identified at time of analysis, the CVE is not on the CISA KEV list, and EPSS data was not provided. Chromium's own internal rating of Medium aligns more closely with the practical risk than the 7.5 CVSS number. The mismatch between PR:N and the described renderer-compromise prerequisite should be noted: defenders should treat this as a sandbox-escape primitive useful to advanced actors chaining bugs, not as a drive-by RCE.

An attacker first lands a separate renderer-process compromise - for example via a chained V8 or Blink memory-corruption bug - when the victim visits an attacker-controlled site. From the compromised renderer, the attacker serves additional crafted HTML that triggers the integer overflow in the Windows CredentialProvider path, escaping the Chrome sandbox and gaining code execution at the user's Windows privilege level (or higher if combined with a Windows LPE). No public exploit has been identified at time of analysis, so this is most plausible in targeted attacks by actors already developing renderer exploits.