Google Chrome EUVD-2026-34757

Exploitation requires a pre-existing compromise of Chrome's renderer process - the attacker must already have arbitrary code execution inside the sandbox, typically achieved by chaining a separate renderer-side RCE vulnerability. The victim must additionally browse to attacker-controlled content (UI:R / UI required) and the affected ImageCapture code paths must be reachable, with the Chrome version being earlier than 149.0.7827.53 on the Stable channel. High attack complexity (AC:H) in the CVSS vector reflects these chaining and timing requirements, and the bug does not yield privilege escalation against a clean, unexploited browser - limiting realistic targeting to attackers who possess or can buy a working renderer exploit.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.5 (High) on paper, but multiple real-world signals lower the practical priority. CVSS shows network vector and no privileges required, yet the description explicitly states the attacker must have already 'compromised the renderer process' - this is a chained sandbox-escape bug, not a one-shot remote exploit, which is why high attack complexity (AC:H) and user interaction (UI:R) are set. Chromium itself rated the severity as Low, and CISA SSVC reports Exploitation: none and Automatable: no, while acknowledging Total technical impact if exploited. EPSS data is not provided in the input. The bug is not in CISA KEV and no public exploit is identified, so this is a patch-on-normal-cadence issue rather than an emergency, though the Total technical impact justifies prompt rollout within normal Chrome update windows.

An attacker first lures a victim to a malicious or compromised web page that exploits a separate renderer-side vulnerability (e.g., a V8 or Blink memory-corruption bug) to gain code execution inside the sandboxed renderer process. The attacker's renderer payload then invokes the flawed ImageCapture code paths with a crafted HTML/JS sequence to abuse the improper privilege management and elevate privileges beyond the sandbox boundary, gaining broader access to browser-process capabilities and ultimately the user's system. No public exploit identified at time of analysis, and the attack requires both user interaction and a chained renderer-compromise primitive.