Google Chrome EUVD-2026-89150

Exploitation requires the victim to actively load attacker-controlled web content in Chrome before version 154.0.8037.57 (UI:R - user interaction such as visiting a malicious page). The high attack complexity (AC:H) indicates additional non-trivial prerequisites such as specific timing, memory grooming, or a race condition to reliably trigger the incorrectly-resolved name/reference (CWE-706). No authentication or elevated privileges are needed (PR:N). Limiting factors: mandatory user interaction, high complexity reducing reliability, and the fix already shipping in the stable channel - patched or auto-updated browsers are not exposed.

The CVSS 3.1 base score is 8.3 (High) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - network-reachable, unauthenticated, but requiring user interaction (UI:R, i.e. visiting a malicious page) and high attack complexity (AC:H, implying grooming/timing/race conditions). The scope change (S:C) combined with full C:H/I:H/A:H impact is consistent with a sandbox-escape-class or cross-origin/cross-context break rather than a renderer-contained bug, which is the primary reason the score exceeds the AC:H penalty. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so this is 'no public exploit identified at time of analysis' - a real defensive priority given the ubiquity of Chrome, but not evidence of active exploitation. Two data-quality tensions should be flagged: (1) the sole tag 'Information Disclosure' contradicts the vector's I:H/A:H, meaning this is not merely a disclosure bug; and (2) no description is provided, so CWE-706 (Use of Incorrectly-Resolved Name or Reference) and chromium issue 513403696 are the only technical anchors. Overall this is a genuine high-priority patch-now issue for any Chrome fleet, but the AC:H and UI:R metrics meaningfully lower the likelihood of trivial mass exploitation versus an AC:L/UI:N flaw.

An attacker hosts a malicious web page and lures a victim into visiting it (UI:R). The page triggers an incorrectly-resolved name/reference condition (CWE-706) under specific timing or state conditions (AC:H), causing a scope-crossing compromise that yields code execution or cross-context data access with full confidentiality, integrity, and availability impact. No public exploit code is identified at time of analysis.