Google Chrome EUVD-2026-89122

Exploitation requires a user running Google Chrome before 154.0.8037.57 to load attacker-controlled web content (UI:R - the victim must navigate to or interact with a malicious or compromised page); no authentication or prior access is needed (PR:N). What limits it: high attack complexity (AC:H) implies the attacker must satisfy non-trivial preconditions such as specific memory state, heap grooming, or timing/race windows for reliable success, and the user-interaction requirement means it cannot be triggered against an idle browser. It affects default Chrome configurations - no special feature flag is documented, but the exact triggering component is undisclosed (chromium issue 517730821 is restricted).

This is a genuinely high-priority browser vulnerability, though not the most severe class within its cohort. The CVSS 3.1 vector (8.3, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) indicates a network-reachable, unauthenticated flaw with full confidentiality/integrity/availability impact and a scope change (S:C) - consistent with a renderer-level input-validation bug (CWE-20) that crosses the sandbox boundary, i.e. an RCE-class or sandbox-escape-class issue rather than mere information disclosure. Two signals temper the raw score: AC:H means exploitation is non-trivial (requires specific heap grooming, timing, or state setup), and UI:R means the victim must visit or interact with attacker-controlled content. EPSS is not provided, and there is no CISA KEV listing and no public POC, so there is no evidence of active or automated exploitation - this is 'no public exploit identified at time of analysis.' Note a conflict between the metadata and the vector: the sole Tag is 'Information Disclosure,' but I:H and A:H make that label too narrow; the impact is memory-corruption/code-execution-class, not a pure disclosure. Bottom line: patch-urgent because of ubiquity and the S:C/C:H/I:H/A:H profile, but AC:H and required user interaction make mass exploitation less immediate than an AC:L drive-by would be.

An attacker hosts or injects a malicious web page (e.g. via a compromised ad network or a link sent to the victim). When a user running a vulnerable Chrome build browses to it, crafted input triggers the CWE-20 validation flaw; after some grooming/timing (AC:H), memory is corrupted and the scope-changing bug lets attacker code escape the renderer's constraints. No public exploit code is currently identified.