Google Chrome EUVD-2026-36339

Attacker must already have local access to the Windows host to place the malicious file (the description states 'local attacker ... via a malicious file'), Chrome must be the affected pre-149.0.7827.115 build on Windows, and user interaction is required per UI:R - typically opening, downloading, or otherwise causing Chrome to process the crafted file via a Mojo-mediated path. Exploitation is limited to Windows installations (non-Windows Chrome builds are not listed), requires the victim to perform an action on the malicious file, and assumes the standard Chrome process model is in use; hardened deployments that block untrusted file execution or restrict Chrome's file-handling capabilities reduce the attack surface.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 8.8, but the description explicitly characterizes this as a local attack via a malicious file, so the AV:N rating from the NVD-style vector overstates remote reach - verify with the vendor advisory which calls this a local privilege escalation. EPSS and CISA KEV status are not provided in the input, and no public exploit is identified at time of analysis, so the realistic risk is moderate: an attacker still needs a foothold on the Windows host and must induce user interaction (UI:R) to open or trigger the malicious file. The Chromium 'security severity: High' rating, combined with the privilege-escalation outcome (full C/I/A impact at the OS level), means this should be patched on a normal Chrome update cadence but does not rise to emergency status absent KEV listing or public exploit code.

A local user - or malware already running as a standard user - drops a specially crafted file in a location that Chrome's Mojo-backed components will process, then triggers Chrome (with the required user interaction, per UI:R) to consume it, causing the IPC layer to mishandle privilege boundaries and grant the attacker code execution at a higher OS privilege level. No public exploit is identified at time of analysis, but the Chromium issue tracker entry 516808201 will eventually surface technical details that could accelerate exploit development.