Google Chrome EUVD-2026-89148

Exploitation requires LOCAL access to a machine running Google Chrome prior to 154.0.8037.57 (AV:L); per the CVSS vector no privileges (PR:N) and no user interaction (UI:N) are needed once local access exists. The flaw is a missing authorization check (CWE-862), so the realistic prerequisite is the ability to execute or interact with the vulnerable Chrome component locally rather than reaching it over the network. Limiting factors: the local attack vector means a remote, unauthenticated web-based attack is not supported by the provided data; the specific feature, protocol, or configuration that exposes the missing check cannot be named because the description is unavailable, and the unusual AV:L/UI:N combination for a browser should be confirmed against the vendor advisory before relying on it.

Signals are mixed and point to a moderate, non-urgent priority despite the high 8.4 base score. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning the attacker needs LOCAL access (AV:L) but no privileges or user interaction, with full high impact to confidentiality, integrity and availability - the score is driven by the triple-high impact, not by remote reachability. EPSS is low at 0.22% (12th percentile), the CVE is NOT on CISA KEV, and no public exploit was identified, so there is no evidence of active or imminent widespread exploitation. The local attack vector materially constrains real-world risk: an attacker must already have code or a foothold on the host, which is unusual for a browser vulnerability normally reached via a malicious web page. Key conflict to verify: the input description is '[Unknown description]', the CWE is CWE-862 (Missing Authorization) while the tag reads 'Authentication Bypass', and AV:L/UI:N is atypical for a Chrome flaw that would usually require the victim to visit a page (expect UI:R) - these should be reconciled against the Chromium issue tracker and Google's advisory before treating the vector as authoritative. Net: real but not a drop-everything priority given low EPSS, no KEV, no POC, and a local vector.

An attacker who already has local access to a system running a vulnerable Chrome build (before 154.0.8037.57) abuses a missing authorization check to bypass an intended access control and read or modify sensitive browser-managed data with no additional privileges or user interaction. No public exploit code was identified, and the local attack vector means this is a post-foothold escalation or data-access step rather than a drive-by compromise.