Google Chrome EUVD-2026-89128

Exploitation requires the victim to visit or interact with attacker-controlled web content (UI:R) using an unpatched Chrome build older than 154.0.8037.57. The attack is unauthenticated and network-delivered (AV:N/PR:N) - no special browser configuration or feature flag is named - but attack complexity is high (AC:H), meaning the attacker must reliably groom the heap and win a timing/lifecycle race to convert the use-after-free into control. The scope change (S:C) implies escaping the renderer sandbox. Limiting factors: mandatory user interaction, the high-complexity exploitation primitive, and Chrome's automatic update mechanism, which rapidly shrinks the exposed population once the September 2026 stable release rolls out.

This is a CWE-416 use-after-free in Google Chrome carrying a vendor-assigned CVSS 3.1 score of 8.3 with the vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. The network vector (AV:N), no-privilege requirement (PR:N), scope change (S:C), and full high impact across confidentiality, integrity, and availability place this in the sandbox-escape-class RCE category typical of Chrome renderer memory-corruption bugs - a successful exploit escaping the renderer sandbox to affect other components. The two signals that temper raw severity are AC:H (high attack complexity - the UAF likely needs precise heap grooming or a timing race to win) and UI:R (the victim must actively visit or interact with attacker content). No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so exploitation status is 'no public exploit identified at time of analysis.' Because Chrome is auto-updating and this was fixed in a September 2026 stable channel release, the practical window closes quickly for patched fleets; the real risk is concentrated in unpatched or update-delayed endpoints. Note the tag 'Information Disclosure' conflicts with the I:H/A:H impact metrics - this is a full memory-corruption RCE-class flaw, not a mere disclosure issue.

An attacker hosts a malicious web page (or injects a malicious ad/iframe into a legitimate site) that triggers the use-after-free in Chrome's rendering engine when a victim navigates to it. Exploiting the freed object requires heap grooming and favorable timing (AC:H), after which the attacker corrupts memory to achieve code execution that crosses the sandbox boundary (S:C). No public proof-of-concept is available at time of analysis.