Google Chrome EUVD-2026-34712

Exploitation requires two sequential conditions to be met: first, the attacker must have already successfully compromised the Chrome renderer process via a separate, independent vulnerability - this is a hard prerequisite stated explicitly in the CVE description and reflected in the AC:H CVSS rating. Second, user interaction is required (UI:R), meaning the victim must visit or interact with an attacker-controlled crafted HTML page within the already-compromised browser session. The vulnerability affects only Chrome versions prior to 149.0.7827.53. Exploitation is limited by: the mandatory prior renderer compromise (a significant technical barrier), the requirement for user interaction, the unchanged scope (S:U, no sandbox escape), and a low confidentiality impact ceiling with no integrity or availability impact. Default Chrome configurations are affected once the renderer is compromised, but the renderer compromise prerequisite means this is not remotely exploitable as a standalone entry point.

CVSS 3.1 (Low) accurately reflects the constrained real-world impact of this vulnerability. The AC:H designation is particularly important - it captures the hard prerequisite of a prior renderer compromise, which itself requires exploiting a separate, typically higher-severity Chromium vulnerability. UI:R further limits exploitation to scenarios where a user visits or interacts with a crafted HTML page. The confidentiality impact is Low (C:L) with no integrity or availability impact, meaning the attacker gains only partial read access - likely scoped to Password Manager state rather than full credential exfiltration. EPSS data was not provided in the available intelligence, preventing a probability-based exploitation likelihood estimate. There is no CISA KEV listing and no public POC identified at time of analysis, both consistent with the low severity rating. The overall risk profile is low for most organizations: this is not an exploitable standalone entry point, and its usefulness is limited to attackers who have already achieved a meaningful foothold via a separate, more complex renderer exploit chain.

An attacker would first need to exploit a separate, higher-severity Chromium renderer vulnerability to compromise the renderer process in the victim's browser session - for example, by directing the user to a malicious web page hosting that initial exploit. Once the renderer is compromised, the attacker's controlled renderer code serves a crafted HTML page that triggers the insufficient policy enforcement flaw in the Password Manager, bypassing discretionary access control to read partial credential or policy state. No public exploit code exists for this specific CVE at time of analysis.