Google Chrome EUVD-2026-89213

Exploitation requires the victim to load attacker-controlled web content in Google Chrome - visiting a malicious page or rendering a malicious embedded resource (ad/iframe) - consistent with UI:R in the vector. No authentication is required (PR:N) and the attack is remote over the network (AV:N) with low complexity (AC:L). The primary limiting factor is the required user interaction; there is no non-default configuration prerequisite indicated. The exact triggering feature/component cannot be named because the CVE description is unavailable, so defenders should treat any untrusted web browsing on unpatched Chrome as at-risk and prioritize deploying the fixed stable-channel build.

This is a Google Chrome CWE-416 use-after-free carrying a CVSS 9.6 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - the scope change (S:C) plus full C/I/A impact signals a memory-corruption bug capable of escaping the renderer sandbox, the highest-consequence class of browser flaw. The only gating factor is user interaction (UI:R): the victim must visit or interact with attacker-controlled web content, which is trivially achievable at scale. A vendor patch is confirmed available (Chrome stable-channel update). Against these severity signals, the exploitation-likelihood signals are ABSENT rather than negative: no EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation or weaponized exploit code at this time. Note a data caveat: 'Reported by: vendor:ubuntu' reflects the Ubuntu package/security tracker surfacing the CVE, not the original discoverer - the authoritative source is the Google Chrome release advisory. The actual affected component (e.g., V8, ANGLE, WebGPU, Blink subsystem) is not stated because the description is '[Unknown description]'; this limits precision on exploit conditions. Overall: a genuinely high-priority patch-now issue given Chrome's ubiquity and the RCE-class impact, but without KEV/EPSS/POC it should be treated as high-severity-not-yet-known-exploited rather than confirmed in-the-wild.

An attacker hosts a malicious web page (or injects a malicious ad/iframe into a legitimate site) that triggers the use-after-free when a Chrome user visits it. Exploiting the freed-then-reused object gives the attacker memory control leading to arbitrary code execution, and the scope change suggests a path beyond the renderer sandbox. No public exploit code is identified at time of analysis, and success requires the victim to load the attacker's content (UI:R).