Google Chrome EUVD-2026-35246

Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build (prior to 149.0.7827.103) that exercises the ViewTransitions API, so user interaction (navigating to or being redirected to the malicious page) is mandatory per the CVSS UI:R metric. No authentication is needed on the attacker side (PR:N) and the page can be delivered cross-origin over any network path the victim's browser can reach. Limiting factors: scope is unchanged (S:U), so code execution is confined to the renderer sandbox and a separate sandbox-escape primitive is required for full host compromise; users on already-updated Chrome 149.0.7827.103+ or browsers with ViewTransitions disabled are not exploitable; and enterprise environments enforcing Strict Site Isolation further constrain the blast radius of a successful renderer compromise.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H produces an 8.8 score driven by network reach, low complexity, no privileges, and full CIA impact, tempered by required user interaction (visiting a malicious page) and unchanged scope (sandbox-confined). Real-world risk is meaningful but not maximal: browser use-after-frees are routinely chained with sandbox-escape bugs to achieve full RCE on the host, and Chrome's massive install base makes drive-by delivery trivial, yet this CVE alone yields only in-sandbox code execution. There is no EPSS score, KEV listing, or public POC provided in the input, so the signal mix suggests a pre-emptive vendor fix rather than observed in-the-wild abuse; the standard Chromium pattern is that technical details and exploits often emerge weeks after the stable-channel release, so the window of low public-exploit risk is likely temporary. Note that the EUVD-supplied affected-versions string 'Chrome 149.0.7827.103 <149.0.7827.103' is internally inconsistent and should be read as 'all builds strictly less than 149.0.7827.103'.

An attacker hosts a malicious page that uses the ViewTransitions API to trigger the use-after-free, then lures a Chrome user to visit it via phishing email, a malvertising chain, or a watering-hole compromise on a trusted site. When the victim's browser parses the page and initiates the transition, the freed object is reclaimed with attacker-controlled data, yielding arbitrary code execution inside the renderer sandbox; the attacker would then need a separate sandbox-escape bug to pivot to the host. No public exploit has been identified at time of analysis.