Google Chrome EUVD-2026-89221

Exploitation requires the victim to load attacker-controlled web content in an affected Chrome build (any version below 154.0.8037.57 on the desktop stable channel), consistent with UI:R - a single page navigation suffices; no authentication or prior privileges are needed (PR:N). This works against default Chrome configurations, so no special feature toggle or non-default setting is implied by the available data. The primary limiting factor is the required user interaction (visiting or being redirected to a malicious page) and the fact that a patched build is already available from Google; the scope change (S:C) implies the memory corruption is impactful enough to affect resources beyond the initially vulnerable renderer component.

This is a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C, C:H/I:H/A:H, score 9.6) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim visit a page, with a scope change indicating the impact crosses the renderer sandbox boundary - the hallmark of a browser RCE/sandbox-escape class bug. The CWE-416 (use-after-free) classification aligns with full C/I/A impact via memory corruption. However, several exploitation signals are MISSING: no EPSS score is provided, the flaw is NOT in CISA KEV (no confirmed active exploitation), and no public POC is referenced. So this is a critically-severe-but-unproven-in-the-wild issue: prioritize patching because of ubiquity and impact class, not because of observed exploitation. The 'Information Disclosure' tag CONFLICTS with the vector - I:H and A:H make this a code-execution/memory-corruption issue, not mere disclosure. Note also the description is unavailable ('[Unknown description]'), so all technical detail here is inferred from the CVSS vector, CWE, and the Chrome stable-channel advisory rather than a vendor narrative.

An attacker hosts or compromises a web page containing content that triggers the use-after-free in the affected Chrome component; when a victim on an unpatched build (<154.0.8037.57) navigates to it, the freed-object reuse corrupts memory and, combined with the scope change, enables code execution beyond the renderer sandbox. No authentication is required and only a single page visit (user interaction) is needed. No public exploit code is identified at time of analysis.