Google Chrome EUVD-2026-35239

Exploitation requires the victim to be running Google Chrome on macOS at a version below 149.0.7827.103 and to load attacker-controlled HTML/JavaScript in that browser (UI:R - typically clicking a link, opening a malicious ad, or visiting a compromised site). No authentication or prior access to the victim system is needed (PR:N), but the high attack complexity (AC:H) implies the exploit depends on race conditions, heap layout, or version-specific object reuse patterns that may not succeed on every attempt. Limiting factors: the bug is scoped to the macOS build per the description, Site Isolation contains initial code execution to a single renderer process, and a separate sandbox escape is generally required to compromise the host beyond the renderer.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H scores 7.5 and indicates a network-exploitable bug requiring no privileges but with high attack complexity and required user interaction - typical of browser memory corruption that needs a victim to load a malicious page and may depend on heap grooming or specific timing. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so probabilistic exploitation likelihood cannot be quantified, and there is no public exploit identified at time of analysis. Google labels the upstream Chromium severity as Critical, which signals high developer concern, but the combination of AC:H plus UI:R and platform restriction to macOS suggests this is a real priority to patch on the standard browser-update cadence rather than a drop-everything emergency - assuming no in-the-wild reports surface. Defenders should treat the gap between vendor 'Critical' rating and a 7.5 base score as a known artifact of CVSS not weighing UAF chainability heavily.

An attacker hosts a malicious web page that triggers a specific sequence of compositor operations to free a Compositing object and then reuse the dangling reference with attacker-controlled data, achieving arbitrary code execution inside the Chrome renderer process on macOS. The victim is lured to the page via phishing, malvertising, or a watering-hole compromise; the high attack complexity implies reliable exploitation likely requires heap grooming and may be chained with a separate sandbox escape to reach the host. No public exploit identified at time of analysis.