Google Chrome EUVD-2026-35226

Exploitation requires that the attacker has already compromised the Chrome renderer process - this is explicitly stated in the CVE description and is the gating prerequisite, meaning the bug is a sandbox-escape primitive rather than a standalone remote vulnerability. The victim must additionally visit and interact with a crafted HTML page (UI:R), and the attack complexity is High (AC:H), indicating non-trivial timing, heap grooming, or state preconditions inside the Tracing component must be met. The affected target is any Chrome desktop install on a version below 149.0.7827.103; patched installs and Chromium downstreams that have rebased are not exploitable. No special non-default configuration is required on the victim side beyond running a vulnerable Chrome build.

Signals here are mixed and point to a serious-but-not-emergency issue. CVSS 8.3 reflects network attack vector, high impact, and a scope change (renderer to browser process), but attack complexity is High and user interaction is Required, both of which dampen real-world exploitability. SSVC confirms this: Exploitation is 'none', Automatable is 'no', and Technical Impact is 'total' - meaning if exploited the consequences are severe, but mass automated abuse is unlikely. Crucially, the CVSS PR:N rating is misleading on its own because the vulnerability description itself requires the attacker to have already compromised the renderer process, so this is realistically a second-stage bug used to chain a sandbox escape onto a prior RCE rather than a standalone remote-unauthenticated exploit. There is no CISA KEV listing, no public PoC reported, and EPSS data was not provided in the input. The bug is not actively exploited as far as available data shows, so this should be patched on Chrome's normal stable-channel cadence rather than treated as an out-of-band emergency, while acknowledging that Chromium sandbox escapes are routinely chained by exploit kits and commercial spyware vendors once public.

A targeted user visits an attacker-controlled or compromised website and is induced to interact with it (the UI:R requirement), which first triggers a separate renderer-side RCE to gain code execution inside the sandboxed renderer. The attacker's renderer-side payload then sends crafted IPC messages to the browser process's Tracing component, triggering the use-after-free to corrupt memory and pivot execution into the browser process, escaping the sandbox and gaining the user's privileges on the host. No public exploit is identified at time of analysis, so realistic abuse currently sits with advanced actors capable of chaining their own renderer bug.