Google Chrome EUVD-2026-89127

Requires a victim using an unpatched Chrome build below 154.0.8037.57 to actively visit or interact with attacker-controlled web content (UI:R) - no authentication is needed (PR:N) and no special browser configuration is indicated, so default installations are affected. Limiting factors: mandatory user interaction (loading the malicious page), and high attack complexity (AC:H) meaning the attacker must satisfy conditions such as precise timing or memory-state grooming for reliable exploitation. No public exploit code is currently identified, further constraining near-term real-world risk.

CVSS 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) describes a network-reachable, unauthenticated flaw requiring user interaction and high attack complexity, with a scope change (S:C) and full CIA impact - the classic signature of a Chrome renderer/sandbox-relevant memory-safety or input-validation bug reached via a malicious web page. CWE-20 (improper input validation) plus S:C indicates the flaw can affect components beyond the initially vulnerable one, consistent with a sandbox-escape-class issue. Exploitation status: no public exploit identified at time of analysis (no KEV listing, no EPSS score, and no POC referenced). The AC:H metric is a meaningful mitigant - successful exploitation likely needs specific timing, heap grooming, or a precondition, unlike the AC:L Chrome siblings in the same batch. Net: this is a genuinely high-priority patch item because of Chrome's ubiquity and the full-impact scope-change vector, but the AC:H and absence of exploitation signals argue it is not an emergency 'drop-everything' item versus an AC:L actively-exploited counterpart. Data conflict to note explicitly: the input Tag says 'Information Disclosure', but the CVSS vector carries I:H and A:H - the tag understates impact and should not be relied upon for triage.

An attacker hosts or compromises a web page containing crafted content that Chrome improperly validates; a victim running an unpatched Chrome (<154.0.8037.57) is lured into visiting it (UI:R). The malformed input triggers the flaw in a way that crosses a security boundary (S:C), potentially enabling code execution or data compromise beyond the renderer. No public POC or active exploitation is currently identified, and the high attack complexity means reliable exploitation requires favorable conditions.