Google Chrome EUVD-2026-89225

Exploitation requires the victim to run an unpatched Google Chrome earlier than 154.0.8037.57 (September 2026 stable channel) and to interact with attacker-controlled content (UI:R - e.g. open a page, file, or trigger the vulnerable component). The CVSS vector specifies a LOCAL attack vector (AV:L), meaning the trigger is delivered/reached locally rather than as a pure remote drive-by, though the exact vulnerable feature is not disclosed in the available data (description unknown; see chromium issue 517661385). No authentication is required (PR:N) and complexity is low (AC:L). Limiting factors: user interaction is mandatory, and the flaw is fixed in Chrome 154.0.8037.57 so patched/auto-updated installations are not affected.

This is a CWE-416 use-after-free in Google Chrome, NVD-scored CVSS 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Notably the attack vector is LOCAL (AV:L), which diverges from most of the September 2026 Chrome memory-corruption batch that were scored AV:N (network/drive-by) - this suggests the flaw is reached through a locally-delivered vector (a crafted local file, extension, or content opened by the user) rather than a purely remote web page; verify the exact trigger with the Chrome release notes / chromium issue 517661385. Impact is high across confidentiality, integrity and availability (C:H/I:H/A:H), consistent with a memory-corruption bug that can lead to renderer code execution - this is an RCE-class issue, NOT information disclosure as one tag implies. On real-world signals: no EPSS score is provided, the CVE is not in CISA KEV, and no public exploit code is identified, so there is no evidence of active exploitation at time of analysis. However, exploitation requires only low complexity and no privileges beyond a single user interaction (UI:R, e.g. opening content), and the product is ubiquitous, so this warrants prompt patching despite the absence of a known exploit. The 'Information Disclosure' tag conflicts with the I:H/A:H impact metrics and appears mislabeled.

An attacker crafts malicious content (e.g. a web page, document, or file) that, when opened in an unpatched Chrome, triggers a use-after-free in a browser component, corrupting memory to gain code execution in the renderer process. The local attack vector and UI:R requirement mean the victim must open or interact with the attacker-supplied content on their own machine. No public proof-of-concept exploit is identified at time of analysis.