Google Chrome EUVD-2026-89236

Exploitation requires the victim to run Google Chrome desktop at a version below 154.0.8037.57 (Stable channel prior to the September 2026 update) and to visit or interact with an attacker-controlled web page (UI:R), since delivery is via a malicious page rather than a passive network service. The AC:H metric means reliable triggering depends on non-trivial conditions - heap layout grooming or an allocation/timing race to reuse the freed object - so exploitation is not push-button. No authentication is needed (PR:N). Limiting factors: mandatory user interaction, the high attack complexity, and that patched/auto-updated Chrome installations are not affected. No special non-default Chrome configuration is indicated by the data.

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3 HIGH) describes a network-reachable, unauthenticated use-after-free in Google Chrome that requires user interaction and carries a scope change with full confidentiality, integrity, and availability impact - the classic profile of a browser memory-corruption bug leading to RCE-class compromise and potential sandbox escape (S:C). The distinguishing signal versus most siblings in this September 2026 Chrome batch is AC:H, indicating the attacker needs favorable conditions such as heap grooming or a timing/allocation race to reliably trigger the freed-object reuse, which measurably lowers real-world reliability. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is a patch-priority-by-prevalence issue rather than a confirmed active threat. Signals are largely consistent (all impacts High, scope changed, patch available), but note the AC:H raises exploitation cost and the absence of KEV/EPSS/POC argues against imminent mass exploitation; the primary risk driver is Chrome's ubiquity, not demonstrated in-the-wild activity. One conflict worth flagging: the 'Information Disclosure' tag understates a bug rated I:H/A:H, which is memory-corruption/RCE-class, not merely a leak.

An attacker hosts a malicious web page (or malvertisement/compromised site) and lures a Chrome user on a version below 154.0.8037.57 to visit it. The page's crafted JavaScript/DOM sequence frees an object then triggers reuse of the dangling pointer, and with the required heap grooming (AC:H) achieves memory corruption that, given the scope change, can escape the renderer toward code execution. No public exploit code is identified at time of analysis, and success depends on user interaction (visiting/interacting with the page).