Google Chrome EUVD-2026-63600

Exploitation requires two distinct conditions to both be satisfied: first, the attacker must have already achieved code execution within the Chrome renderer process (a separate, preceding vulnerability is required for this stage); second, the victim must be running Google Chrome on a Linux operating system with the Linux Toolkit Theming component active, which is the default configuration for Linux Chrome installs. The crafted HTML page serves as the delivery vehicle for triggering the renderer compromise, but the theming escape itself is triggered from within the already-compromised renderer. Factors that limit exploitation: the two-bug chain requirement substantially raises attacker sophistication; only Linux platform Chrome deployments are affected (the theming component is Linux-specific); user interaction is required to visit the crafted page; and Chrome's sandboxing must be active for the 'escape' to be meaningful. Exploitation against macOS or Windows Chrome builds is not indicated by available data.

The NVD-assigned CVSS base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) materially overstates real-world exploitability because it fails to capture a critical prerequisite: the attacker must have already compromised the renderer process before this vulnerability is useful. In practice, exploiting this vulnerability requires chaining at least two separate bugs - a renderer RCE and this sandbox escape - which significantly elevates attack complexity beyond what AC:L reflects. The S:U (scope unchanged) metric also appears inconsistent with what is explicitly described as a sandbox escape; S:C would be more accurate. EPSS at 0.38% (32nd percentile) corroborates that exploitation has not been observed at scale. No CISA KEV entry exists, and no public POC has been identified. The realistic threat actor is a sophisticated, targeted adversary capable of chaining multiple Chrome exploits - not a commodity opportunistic attacker. For most organizations, risk is medium despite the high CVSS, unless the deployment is a high-value target environment where nation-state or advanced persistent threat actors are a plausible concern.

A targeted attacker first exploits a separate renderer-process vulnerability (e.g., a V8 type confusion or out-of-bounds read bug) to gain code execution inside Chrome's sandboxed renderer on a Linux system, achieved by luring the victim to a specially crafted webpage. With renderer control established, the attacker triggers the Linux Toolkit Theming flaw by manipulating dynamically managed resource references within the theming pipeline, causing improper resource control that crosses the sandbox boundary. This achieves code execution in the browser process or host OS context, providing full access to the user's system - file system, credentials, and network. No public POC for this specific sandbox escape has been identified; exploitation requires significant technical capability to chain the two-stage attack.