Google Chrome EUVD-2026-69748

Two distinct preconditions must both be satisfied: (1) the attacker must have already achieved arbitrary code execution within the Chrome renderer process via a separate vulnerability - this is an explicit prerequisite stated in the description, not an assumption; (2) social engineering is required to induce the user to load a crafted HTML page (UI:R). AC:H reflects both requirements simultaneously. Exploitation is limited to desktop Chrome versions below 152.0.7977.75. Without a concurrent renderer compromise, the TabStrip authorization flaw cannot be reached from an external attacker position. Users who have already applied Chrome 152.0.7977.75 or later are not exposed.

CVSS 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) accurately reflects the high potential impact but also encodes the significant attack complexity. AC:H captures the two-stage precondition: the attacker must first independently compromise the renderer process (a separate vulnerability) and then also rely on social engineering for the TabStrip escape. EPSS data is not provided in the available intelligence; no KEV listing is present, and no public POC has been identified. Real-world exploitation probability is materially lower than the base score suggests - AC:H chained exploits require coordinated attack infrastructure and a separate unpatched renderer vulnerability. This is a meaningful vulnerability warranting prompt patching, but organizations without a concurrent unpatched renderer flaw face substantially reduced risk. The 'Authentication Bypass' tag in the input metadata is a mislabel and does not affect this assessment.

An attacker who has already obtained renderer process execution (via a separate browser exploit) social-engineers the victim into visiting a crafted HTML page - for example, via a phishing link or malicious advertisement. The compromised renderer invokes privileged TabStrip IPC operations without proper authorization, crossing the sandbox boundary and executing attacker-controlled code in the browser process with the user's full OS privileges. No public exploit code for this specific chain has been identified at time of analysis.