Google Chrome EUVD-2026-89125

Exploitation requires the victim to load attacker-controlled web content in Google Chrome versions earlier than 154.0.8037.57 (UI:R - the user must visit a malicious page or view attacker-controlled content such as a malicious ad/iframe); no authentication and no special browser configuration are needed (PR:N, AC:L). Limiting factors: user interaction is mandatory, and because scope is unchanged (S:U) the primitive is contained to the renderer sandbox, so full host compromise realistically needs an additional sandbox-escape vulnerability chained in. A fixed build is already available, so patched installations are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated use-after-free (CWE-416) requiring only that a victim visit a malicious page (UI:R). Scope is unchanged (S:U), meaning impact is contained to the renderer sandbox rather than a full sandbox escape - this is the standard signature of a browser memory-corruption bug that yields renderer-level RCE, typically needing a second chained bug for full compromise. All three impact metrics are High, which contradicts the input Tag 'Information Disclosure': a UAF with I:H/A:H is a memory-corruption/RCE-class flaw, not a pure info-leak. On real-world signals, no EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' However, absence of these signals is common for freshly disclosed Chrome bugs and should not be read as low risk: Chrome UAFs are historically among the most weaponized bug classes, and a vendor patch is already available. Net assessment: a genuinely high-priority patch-now issue driven by the ubiquity of Chrome and the drive-by attack model, tempered only by the S:U containment and the lack of confirmed in-the-wild exploitation.

An attacker hosts a malicious web page (or injects a malicious ad/iframe into a legitimate site) that triggers the use-after-free in Chrome's rendering engine when the victim browses to it. Exploiting the freed-object reuse gives the attacker code execution in the renderer process, which is typically chained with a sandbox-escape bug to fully compromise the host. No public exploit code was identified at the time of analysis.