Google Chrome EUVD-2026-69737

Two sequential conditions must both be met: (1) the attacker must have already compromised the Chrome renderer process - this is not a standalone flaw and requires a separate renderer exploit, making fully automated exploitation against uncompromised browsers impossible with this bug alone; (2) the victim must be running Google Chrome on Windows in a version prior to 152.0.7977.75 and must have visited or be visiting attacker-controlled content. User interaction (UI:R) is required as the user must load the crafted HTML page. Non-Windows Chrome installations are not listed as affected. The high attack complexity (AC:H) directly corresponds to the renderer pre-compromise prerequisite, which limits realistic exploitation to well-resourced actors capable of chaining multiple zero-days.

The CVSS 8.3 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) accurately reflects the attack chain: network-reachable via crafted HTML, but AC:H because exploitation requires a pre-existing compromised renderer - not a standalone one-click bug. The scope change (S:C) and full C:H/I:H/A:H metrics reflect the sandbox escape impact, which is the most severe outcome Chrome's security model is designed to prevent. In practice, this means the real-world exploitability bar is high: an attacker must chain at least two browser vulnerabilities (a renderer RCE plus this sandbox escape), which is characteristic of sophisticated, targeted threat actors rather than opportunistic mass exploitation. No EPSS data was provided and no KEV listing exists, consistent with no confirmed in-the-wild exploitation at time of analysis. The threat is serious but not immediately widespread; organizations with high-value targets (government, finance, critical infrastructure) should prioritize patching given Chrome's ubiquity.

A sophisticated attacker targeting a high-value Windows user first delivers a renderer exploit (via a separate browser bug or malicious page) to gain code execution inside Chrome's sandboxed renderer process. They then serve a crafted HTML page that triggers the GPU stack buffer overflow, hijacking control flow in the GPU process to escape Chrome's sandbox entirely. With code running outside the sandbox, the attacker can access the victim's file system, credentials, and OS resources with the privileges of the Chrome process owner.